aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69

Analysis

max time kernel
176s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:42

Target

aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69.dll
Size

390KB
MD5

2ab40a118415a853056d81aef4df53ed
SHA1

48483a0c3c21eab5d86f51ab046b8a7c39531e0e
SHA256

aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69
SHA512

3590514b98642fbec884b42343e1f0f3b05c1f83a0025df4b9600c774733d236a1cd15dfdaaf5466273d1f5a8f8fb02bfcc7c3149d0da86b90c2f3050489959c
SSDEEP

12288:foEOND+F3Z4mxxKirMmh1NwpBU6YmANogZx:foLNqQmXKAh1NwpBUaKx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2080 wrote to memory of 4924	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 4924	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 4924	2080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69.dll,#1
2⤵
PID:4924