a8848ee8f0ae3d6c5187f8062ee841f3e8c80ea6bc1a4bdc763cb9f273d60c1d

Analysis

max time kernel
74s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:33

Target

a8848ee8f0ae3d6c5187f8062ee841f3e8c80ea6bc1a4bdc763cb9f273d60c1d.dll
Size

5KB
MD5

3cf4b293efadaa02c65df17f57fa7830
SHA1

14ccf83810514714a6f489d3beae83ebcfb232d0
SHA256

a8848ee8f0ae3d6c5187f8062ee841f3e8c80ea6bc1a4bdc763cb9f273d60c1d
SHA512

d9ab73ce1cc18a2da93618d6616ee3d8349854233e61313fb2bcf06ab90ef9df4dd0dac7b113f17af818fbed993ea865a471fa7667fdfe90744a1e9dcf096a71
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEq30fuEh1nykcM/Wc7p2OFX2lkzEg2U:hy859x0P8MasuEjykcnc7pHFXkkIg9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2580	1860	rundll32.exe	52
PID 1860 wrote to memory of 2580	1860	rundll32.exe	52
PID 1860 wrote to memory of 2580	1860	rundll32.exe	52

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8848ee8f0ae3d6c5187f8062ee841f3e8c80ea6bc1a4bdc763cb9f273d60c1d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8848ee8f0ae3d6c5187f8062ee841f3e8c80ea6bc1a4bdc763cb9f273d60c1d.dll,#1
  2⤵
  PID:2580