2fa66bc31fd581d00799c88c50fb79e2eb1d25ad1487b7783a32d6024e539076

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 04:37

Target

2fa66bc31fd581d00799c88c50fb79e2eb1d25ad1487b7783a32d6024e539076.dll
Size

33KB
MD5

9eaec9069340adec271f4b96246d11d0
SHA1

0ffbd3b55b2f6361c85d11f8531f4a39413d9f0a
SHA256

2fa66bc31fd581d00799c88c50fb79e2eb1d25ad1487b7783a32d6024e539076
SHA512

1bb2be601c2a5ff06ba634ac8bebbace6edfd410fa595994c4e5bc42b3a03fdd6725c9cee16ec76cc33ca19e2618fc677f740286feab6f9aeab07a50780049a7
SSDEEP

768:q5rQdVtf/IHuYbUoiPs0XnPF7AHAgqNVOsTRKVs850Y0:srQHtYOYV0Xd74AgU1RKVV50Y0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3820	3628	rundll32.exe	80
PID 3628 wrote to memory of 3820	3628	rundll32.exe	80
PID 3628 wrote to memory of 3820	3628	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa66bc31fd581d00799c88c50fb79e2eb1d25ad1487b7783a32d6024e539076.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa66bc31fd581d00799c88c50fb79e2eb1d25ad1487b7783a32d6024e539076.dll,#1
  2⤵
  PID:3820