af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 23:28

Target

af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd.dll
Size

120KB
MD5

a3146743c6addac006abcaa629598016
SHA1

8cdb96cba7fde1ab7012950e901644aecd5d5158
SHA256

af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd
SHA512

ba36df01522949f74375c3ba3cfdf03e64cad87c219d3acadf88710f9e4a351f98638399ce58f914d94b0ac999777396576b8c3a58d8931d38dc94ebfd2563cc
SSDEEP

3072:6aPP0CdUf+5VLgYLxjQbyagkMbCvwur1S:H5VbFrabO5ug

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4576	4456	rundll32.exe	82
PID 4456 wrote to memory of 4576	4456	rundll32.exe	82
PID 4456 wrote to memory of 4576	4456	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd.dll,#1
  2⤵
  PID:4576

memory/4576-133-0x0000000002400000-0x000000000240B000-memory.dmp

Filesize
44KB

Download
memory/4576-135-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download