2a9e3973170dcb138f42a64efa94899d8ef8d2fab422b38d976afbf063252dee

Analysis

max time kernel
106s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 18:51

Target

2a9e3973170dcb138f42a64efa94899d8ef8d2fab422b38d976afbf063252dee.dll
Size

11KB
MD5

74d2d8ffb1498288fb9d41d6de0b96a0
SHA1

96af169b8d828fc8e0aa358bb18dc813491e2ded
SHA256

2a9e3973170dcb138f42a64efa94899d8ef8d2fab422b38d976afbf063252dee
SHA512

deb7b28d04dc7ab1dc4c1b11ed1317cca36dc9f4da40c3413b988997a6e510ee435f35630a6465a85642fd7a27fa06f6b1f2a0a00f5a97c8ff30b7d80c7802de
SSDEEP

192:+u3VpJsKpPNWT3UQ3FPTjoBnUQLXXzBDg2RaetRw/5L34Kd5zTqV:1VpJOT53FPTjkNQr4Kd5zm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1592	1780	rundll32.exe	35
PID 1780 wrote to memory of 1592	1780	rundll32.exe	35
PID 1780 wrote to memory of 1592	1780	rundll32.exe	35

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a9e3973170dcb138f42a64efa94899d8ef8d2fab422b38d976afbf063252dee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a9e3973170dcb138f42a64efa94899d8ef8d2fab422b38d976afbf063252dee.dll,#1
  2⤵
  PID:1592