af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94

Analysis

max time kernel
284s
max time network
406s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:53

Target

af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94.dll
Size

24KB
MD5

15ece60c7441486453a42f50b9f5a9eb
SHA1

2da7e79bf523dfdedc50321f5e7f41435b373bb7
SHA256

af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94
SHA512

3232220edb53c57e7064ef468331fcf40a41ad50119d3cc5ee3764191f965016ad4200512da9df9d43458983066a9a3b4ae7a4c294b85e073172c727bccba4c8
SSDEEP

192:zsNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXkr:zcG8W59LhtEQA/4O82FV9PS8Vkwkr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 1244	3612	rundll32.exe	79
PID 3612 wrote to memory of 1244	3612	rundll32.exe	79
PID 3612 wrote to memory of 1244	3612	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af1e6353bbced1be0faa30f991fa461fababf21f21a0add95392e331ac97fa94.dll,#1
  2⤵
  PID:1244