a28f8f5888de9a05aaa1ec65a3195211564504ca985ec2cb7f7cc2162197c218

Analysis

max time kernel
207s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:35

Target

a28f8f5888de9a05aaa1ec65a3195211564504ca985ec2cb7f7cc2162197c218.dll
Size

5KB
MD5

bbc6ce38b39f4c1e0cab20122b524bc0
SHA1

80b3e8b67d1ac14c883177f6fa8a2a583c2d2b47
SHA256

a28f8f5888de9a05aaa1ec65a3195211564504ca985ec2cb7f7cc2162197c218
SHA512

097ece419639c9a4b745afd27beb926a32e0a0ee0abf13abb7f1f856a5ce7c9cfe50f864d56e2f81bd9af9cb90bc73166a9446f09dfd327a2d275ef70dde40db
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9Mg/Ad9Zj97IAWuFRE+Ieoa2RcIcO3IAQQNrcGf:nI2RrUeqQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4540	4844	rundll32.exe	81
PID 4844 wrote to memory of 4540	4844	rundll32.exe	81
PID 4844 wrote to memory of 4540	4844	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a28f8f5888de9a05aaa1ec65a3195211564504ca985ec2cb7f7cc2162197c218.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a28f8f5888de9a05aaa1ec65a3195211564504ca985ec2cb7f7cc2162197c218.dll,#1
  2⤵
  PID:4540