2a6f9a095ecd97783727b0097e33961315ff90fd49b21404c4312e549b2fa821

Analysis

max time kernel
175s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:19

Target

2a6f9a095ecd97783727b0097e33961315ff90fd49b21404c4312e549b2fa821.dll
Size

143KB
MD5

76bf3e46049e4821d8352c89ffa55a06
SHA1

d0cea01177b743d8fe8241ea2afe256ce415a9cd
SHA256

2a6f9a095ecd97783727b0097e33961315ff90fd49b21404c4312e549b2fa821
SHA512

a5df9ea3b0d75e3b0bf292439ba945c33095ba2fa7799d4d91f1b25c51f5d3f94740d1909fcb7dc1da278ea0e06e76937d461c9586195614e0bd4f0dee58e21a
SSDEEP

3072:hWQhO8LQCEPY9UXCnx/JlOZ7TpFPE/UkKyjLoowQXID:hWiLXkZCng+vjlwQXY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5080 wrote to memory of 1900	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 1900	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 1900	5080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a6f9a095ecd97783727b0097e33961315ff90fd49b21404c4312e549b2fa821.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a6f9a095ecd97783727b0097e33961315ff90fd49b21404c4312e549b2fa821.dll,#1
2⤵
PID:1900