a64514bfa4142c80cdb0cadb13bcfbceaead993e1bf4764cc97091719de39f03

Analysis

max time kernel
137s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 02:05

Target

a64514bfa4142c80cdb0cadb13bcfbceaead993e1bf4764cc97091719de39f03.dll
Size

5KB
MD5

df2ce95d1197874be696d1ca1cd876f0
SHA1

817ea0a6bc89d6235c94c42abb7f1860d6fb3c50
SHA256

a64514bfa4142c80cdb0cadb13bcfbceaead993e1bf4764cc97091719de39f03
SHA512

6155170b22727a754ea5e196ee0c0ae46385a38ea222d1ed25fc239b79bae3b2780e92b4198b92cb7feaf504a2ebd01f6ce68d7610e28b4cd355b9ee61fe4774
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9MgRimkQzIPR6hCkZgqpEOe+hY3KodPji:nI2RrUeqhrbgQkP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 4248	2100	rundll32.exe	79
PID 2100 wrote to memory of 4248	2100	rundll32.exe	79
PID 2100 wrote to memory of 4248	2100	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a64514bfa4142c80cdb0cadb13bcfbceaead993e1bf4764cc97091719de39f03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a64514bfa4142c80cdb0cadb13bcfbceaead993e1bf4764cc97091719de39f03.dll,#1
  2⤵
  PID:4248