e2af4f8cdb89257dbe599f8766d9bd5ce2807235d0c5c37dfb969964ff051fdb

Analysis

max time kernel
150s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:11

Target

e2af4f8cdb89257dbe599f8766d9bd5ce2807235d0c5c37dfb969964ff051fdb.dll
Size

6KB
MD5

76df60b26c4ad5fc396bc9bd624cffb0
SHA1

d630c34d3c0b5b3084e365a2219fe04db118267d
SHA256

e2af4f8cdb89257dbe599f8766d9bd5ce2807235d0c5c37dfb969964ff051fdb
SHA512

7c6ff32edbce9bb69ddcd95ed442c9c301e92ba401f54dc1b522175d5776ea04f25fb5ba8e0f7ade56c0928e80dfba4573281984c694110beec764f1e44bf951
SSDEEP

96:nI2RrUeqDtpSH/uLMEA9x7EaxjnPopbC6w6T4vD47BWZ:XR4e6t/AL7Ea5op+6wbD47B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3792	2896	rundll32.exe	82
PID 2896 wrote to memory of 3792	2896	rundll32.exe	82
PID 2896 wrote to memory of 3792	2896	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2af4f8cdb89257dbe599f8766d9bd5ce2807235d0c5c37dfb969964ff051fdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2af4f8cdb89257dbe599f8766d9bd5ce2807235d0c5c37dfb969964ff051fdb.dll,#1
  2⤵
  PID:3792