a0f91eaf9591fed0e3e410b2840ce312031ddf79cd6b04c94b962f0ec49b2bbf

Analysis

max time kernel
95s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:55

Target

a0f91eaf9591fed0e3e410b2840ce312031ddf79cd6b04c94b962f0ec49b2bbf.dll
Size

70KB
MD5

f72f5d48fa31bce207b50982aa22fc16
SHA1

c0457f3b41f75d60569434f6a56d5694cb50f656
SHA256

a0f91eaf9591fed0e3e410b2840ce312031ddf79cd6b04c94b962f0ec49b2bbf
SHA512

d38c21fe56bd6aa17d793c67134f774d4e5b7adfa7adcf891e7e5c0fa1b05f079ae8682974175abe0b8411017e6d6fdaa1f05972838caf0bcfd64cd0454e6c2d
SSDEEP

1536:evYmbKc9rsyNmw1WoY94UNN67LIsArYffWI6s/YdU:hKJ9QyNm3/DNN2c583WQQm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3052	1476	rundll32.exe	79
PID 1476 wrote to memory of 3052	1476	rundll32.exe	79
PID 1476 wrote to memory of 3052	1476	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0f91eaf9591fed0e3e410b2840ce312031ddf79cd6b04c94b962f0ec49b2bbf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0f91eaf9591fed0e3e410b2840ce312031ddf79cd6b04c94b962f0ec49b2bbf.dll,#1
  2⤵
  PID:3052