faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60

Analysis

max time kernel
161s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 15:54

Target

faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60.dll
Size

15KB
MD5

0ee8b5f6d688b07387052688c3ddc259
SHA1

c2d1ea4b5e0317efb129cdee03a9e781ee3a7637
SHA256

faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60
SHA512

af752432bb31c056f80bc0bed71ad604bfa12893c785a8f1cba98c070630e311b78c69aed6df44abfe5c193c076c9f8c4428a59d10bc93c138030b38f71f8234
SSDEEP

192:vvsh4BfiN1VFLEW0Ui/JKWTSZm4/VfsbmN1aV0MSoJdXeykYKWxVoD+cLk:XshegwUYKWTSZmCfMmNgWMSoJevXrL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1552	4468	rundll32.exe	81
PID 4468 wrote to memory of 1552	4468	rundll32.exe	81
PID 4468 wrote to memory of 1552	4468	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\faa1c279731d4e24ac286924f35a11742d7985b29794dba83aea00f21fe29b60.dll,#1
  2⤵
  PID:1552

memory/1552-133-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1552-134-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download