fa61e575c1b3393d1d82eb212d38054e05aa5551c44259cc52b5abdd4c4a2294

Analysis

max time kernel
188s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:43

Target

fa61e575c1b3393d1d82eb212d38054e05aa5551c44259cc52b5abdd4c4a2294.dll
Size

6KB
MD5

1800d08d21507e143bcab5ce52e01ae0
SHA1

ad9a954bc01be39dbb0a5db2073ce04c7cfdfaf0
SHA256

fa61e575c1b3393d1d82eb212d38054e05aa5551c44259cc52b5abdd4c4a2294
SHA512

34d3bc410a85d0ad8fb99302fde8bacd6448042c33bdf4ce3f13108ad5646bd2cb7715731ce5e4e7cc2d6cb13882f5ac0a92bd3dd5ef3c5a53bff44604d5ff7b
SSDEEP

96:nEY2RrF1eqwi4xfvVZWWsE9ar1KXepNkYsOUdjUeabOVem21ANaoPhu:EHRh1eppxfvBaAOPsOUNy6VeH1vmhu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 5040	2560	rundll32.exe	79
PID 2560 wrote to memory of 5040	2560	rundll32.exe	79
PID 2560 wrote to memory of 5040	2560	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa61e575c1b3393d1d82eb212d38054e05aa5551c44259cc52b5abdd4c4a2294.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa61e575c1b3393d1d82eb212d38054e05aa5551c44259cc52b5abdd4c4a2294.dll,#1
  2⤵
  PID:5040