a195ee59d73e2bd80016d655663c667a3b6f84083cce73e9cf0841d2329303aa

Analysis

max time kernel
142s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:32

Target

a195ee59d73e2bd80016d655663c667a3b6f84083cce73e9cf0841d2329303aa.dll
Size

6KB
MD5

b0742eac7a46623d88f5a9d09676b730
SHA1

ca1c9367530047351c2493352dc346296099cd3d
SHA256

a195ee59d73e2bd80016d655663c667a3b6f84083cce73e9cf0841d2329303aa
SHA512

378e0745b6cbfe6e27bf3ac0972ee884186f669b291d1f236ff8ccbef68ce7af0b8ef86d29afa14956228b093ba306c426e88b92c1e5ab4c81bbc1b4ebf017f5
SSDEEP

96:nEY2RrF1eqwi4x560UAMHWTbdJwY8pdZUKPJUOWsqwGJu:EHRh1eppLrVHwYMa2uC6Ju

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4764	4584	rundll32.exe	80
PID 4584 wrote to memory of 4764	4584	rundll32.exe	80
PID 4584 wrote to memory of 4764	4584	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a195ee59d73e2bd80016d655663c667a3b6f84083cce73e9cf0841d2329303aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a195ee59d73e2bd80016d655663c667a3b6f84083cce73e9cf0841d2329303aa.dll,#1
  2⤵
  PID:4764