2fa47ca71d967dbd213efae41de4e20e07aaa9d404e41d4fbfecb9d91b9b6b58

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:04

Target

2fa47ca71d967dbd213efae41de4e20e07aaa9d404e41d4fbfecb9d91b9b6b58.dll
Size

67KB
MD5

5b0f051df4df6d564a3151643e8c1b2e
SHA1

202410691d6b33024ebb23f5b4084428f2408ec8
SHA256

2fa47ca71d967dbd213efae41de4e20e07aaa9d404e41d4fbfecb9d91b9b6b58
SHA512

1b8de1522c0aa7a7b8fb46203cf357eeca557808927d28313bbbfc47e2e2f40d7c91a78bad03ee50455102c3d8b210c7a5e653722bfa8dffa430d8618bfdc7c6
SSDEEP

1536:HKvv9jeCw6l9n+Eu2TCS3Qs2PYWaK/qQrHU8rAuxhbyf:TSHu2OoQHPYW1irahS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2044	4992	rundll32.exe	81
PID 4992 wrote to memory of 2044	4992	rundll32.exe	81
PID 4992 wrote to memory of 2044	4992	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa47ca71d967dbd213efae41de4e20e07aaa9d404e41d4fbfecb9d91b9b6b58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa47ca71d967dbd213efae41de4e20e07aaa9d404e41d4fbfecb9d91b9b6b58.dll,#1
  2⤵
  PID:2044