a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d

Analysis

max time kernel
278s
max time network
406s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:00

Target

a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d.dll
Size

32KB
MD5

f43457e6a5f61eb2207fc248001e6e7a
SHA1

278811c498895c7e9548fbed19796bbc970bd1cc
SHA256

a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d
SHA512

8e1798153f58a1556d5f916d2d82e4c7d0777e25fff2ac60116411f5a2485030fd7c42fedecc8b0d4733779c8fef6716ed20835ec659845128f1636a6cfd11c4
SSDEEP

384:dWRxD56W1rRy2408lh/jkcIRagzN5wj7D77iYfiIuIzawYJFJLCRCkI8a:K1QWtHd8PZIaaN5kD75KINzhqDmRCkIT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2364	4720	rundll32.exe	80
PID 4720 wrote to memory of 2364	4720	rundll32.exe	80
PID 4720 wrote to memory of 2364	4720	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4e4f5839514a504669c4a9d2f72c7f81c91f7f3f624bc02b80eaa6d4907e32d.dll,#1
  2⤵
  PID:2364