af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd

Analysis

max time kernel
111s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:45

Target

af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd.dll
Size

20KB
MD5

55d308f64c57e382583eb18757abd535
SHA1

6651f5b570b57e4998c2bfe042732b7e59e20914
SHA256

af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd
SHA512

ed2fb62c2b2dc5c29bd5a02356657ba05569241fc19b2892b887a1b6e2fc2708a1b5fecd7552dce31e377c6b67a40002206ec229574906172d0acf57826e90f3
SSDEEP

384:3i5lOwy/HmXfNsU4WqTRsUzlkY1O5JpJgLa0MpFA:hT/HmXf6fRsUzmtLgLa1o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4316	4880	rundll32.exe	53
PID 4880 wrote to memory of 4316	4880	rundll32.exe	53
PID 4880 wrote to memory of 4316	4880	rundll32.exe	53

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af287ea4f1350cccd83d49f41733fe6750b3f40cd40531bb233747e143d90dbd.dll,#1
  2⤵
  PID:4316