8a4f2e4e941e465991c92559106fc0ab60de3a4533ce88c74bf78c83f4214321

Analysis

max time kernel
155s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:37

Target

8a4f2e4e941e465991c92559106fc0ab60de3a4533ce88c74bf78c83f4214321.dll
Size

67KB
MD5

7002002616223c4cc026c382e5174b20
SHA1

efa36777e0b35c6f719a63c10c33fef809007f4f
SHA256

8a4f2e4e941e465991c92559106fc0ab60de3a4533ce88c74bf78c83f4214321
SHA512

b429c57d66fdd35babd7f8bc37ce18482f9735826747aa7a5cf6fd56610afbaa3e84bae65a04a539f60a02c33c105c4cc5450106eaa07f425466d983ae31b7d0
SSDEEP

1536:RV2OSen+zFhHRSrBQ9+o9TdSHQqzh31IePCE7jcP:Tri2raxNmFzhBaicP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3376	4900	rundll32.exe	83
PID 4900 wrote to memory of 3376	4900	rundll32.exe	83
PID 4900 wrote to memory of 3376	4900	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a4f2e4e941e465991c92559106fc0ab60de3a4533ce88c74bf78c83f4214321.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a4f2e4e941e465991c92559106fc0ab60de3a4533ce88c74bf78c83f4214321.dll,#1
  2⤵
  PID:3376