a04c4b3cae9f9da815d0a4b4e37138a080aa1e72cce024e6d3aad0ac708b99b4

Analysis

max time kernel
189s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 02:00

Target

a04c4b3cae9f9da815d0a4b4e37138a080aa1e72cce024e6d3aad0ac708b99b4.dll
Size

7KB
MD5

f7f2136500c381ed7b8a475ecf7aa200
SHA1

f3e5020790b2d194f8e693b38c8dfa3b12ed07fe
SHA256

a04c4b3cae9f9da815d0a4b4e37138a080aa1e72cce024e6d3aad0ac708b99b4
SHA512

e285ae407dbaad3781bc375f9b2118cd72223b9e6303eb62e65dd23ddcd9d384a716df0d8d214b853aad2b5e44ed429407f3ed9c29ef821f69d04f12726cd8fd
SSDEEP

48:iYbAgC8j1gAVAHoyrhWR0hiIsilOdQUgOrnsB/uSi20:bbAuRnqoyrY0AI/lBkn/00

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 2632	328	rundll32.exe	81
PID 328 wrote to memory of 2632	328	rundll32.exe	81
PID 328 wrote to memory of 2632	328	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a04c4b3cae9f9da815d0a4b4e37138a080aa1e72cce024e6d3aad0ac708b99b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a04c4b3cae9f9da815d0a4b4e37138a080aa1e72cce024e6d3aad0ac708b99b4.dll,#1
  2⤵
  PID:2632