a22b9077a3b36cd6a0dab2e7fdb50c95eed59a4f3e59ccf47d4858597cdec217

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:30

Target

a22b9077a3b36cd6a0dab2e7fdb50c95eed59a4f3e59ccf47d4858597cdec217.dll
Size

6KB
MD5

6a67a5b20332ce0b8cb2c8b7afab2f20
SHA1

eeac3dc69d12d90a746ef57958476719f5fd9d32
SHA256

a22b9077a3b36cd6a0dab2e7fdb50c95eed59a4f3e59ccf47d4858597cdec217
SHA512

88bd1628b104bfee58d75b368b780e2442df71d049dec401df51f5deae55ce173b872a12a18c089009057eabfda1f421bee5435feb88eaa3bd0ec154b7805a21
SSDEEP

96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD79auX9:juLJ/oAdQPQa2aeng795X9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4656	4756	rundll32.exe	79
PID 4756 wrote to memory of 4656	4756	rundll32.exe	79
PID 4756 wrote to memory of 4656	4756	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a22b9077a3b36cd6a0dab2e7fdb50c95eed59a4f3e59ccf47d4858597cdec217.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a22b9077a3b36cd6a0dab2e7fdb50c95eed59a4f3e59ccf47d4858597cdec217.dll,#1
  2⤵
  PID:4656