a1e6f2d6ac328bb1d8e38dfb6702b52c70125089aa8972761213df37656c73f6

Analysis

max time kernel
92s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 03:55

Target

a1e6f2d6ac328bb1d8e38dfb6702b52c70125089aa8972761213df37656c73f6.dll
Size

45KB
MD5

5ae707d45b678536e967c1632b35f79d
SHA1

0a90408c02cfa1ef451e5cedc4456a81f098405f
SHA256

a1e6f2d6ac328bb1d8e38dfb6702b52c70125089aa8972761213df37656c73f6
SHA512

f8f62390b72a68861e3c280f3d27398c3c84fbc0278e1c43e7d37ae859609bb8e483a9b033bb1551db252f307b2a2e1f35efec754594958b339ebc76cc4a53d1
SSDEEP

768:GbvLDaaMact8TIZC41fDmhO3yKySzBNUpldYkfeDsRu4J7zMuFaSWnoCzw:ev+C41fDmhOJjtUldTGAuKzMMaS4oC8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 5060	4932	rundll32.exe	81
PID 4932 wrote to memory of 5060	4932	rundll32.exe	81
PID 4932 wrote to memory of 5060	4932	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e6f2d6ac328bb1d8e38dfb6702b52c70125089aa8972761213df37656c73f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1e6f2d6ac328bb1d8e38dfb6702b52c70125089aa8972761213df37656c73f6.dll,#1
  2⤵
  PID:5060