af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08

Analysis

max time kernel
186s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:11

Target

af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08.dll
Size

263KB
MD5

e7f09920ad6fda9d4640d7a6fe72e6f3
SHA1

691633f26f786f7090b0bfcbc19219c9a146e014
SHA256

af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08
SHA512

a05fda3128806e402e1bd5825561f4f67301692e983145f07d530a1edf8e82485f4864c2464a2f5070847542346c083728ccc9f8997708cff73fc9b2aac9f041
SSDEEP

6144:EPtFJxLBX2aP7EKJDqahkrijCdpaaO8TRn9iEqJ8kJj8w24XVt:ED1VP7LDhkriMOEn7qjqw9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3916 wrote to memory of 4724	3916	rundll32.exe	rundll32.exe
PID 3916 wrote to memory of 4724	3916	rundll32.exe	rundll32.exe
PID 3916 wrote to memory of 4724	3916	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af451acd8c876bfd3945f134dee460f236f396c4794e1ffe1f514d930d812f08.dll,#1
2⤵
PID:4724