a4dceef103cbdcd56f031389477bdfca3e1b0ba730d701c94df61a72cd47b31b

Analysis

max time kernel
153s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 10:41

Target

a4dceef103cbdcd56f031389477bdfca3e1b0ba730d701c94df61a72cd47b31b.dll
Size

6KB
MD5

53136cd2e1c0e2d3bb49a54dc4748d20
SHA1

3a9feabfe4fa8744878ee5354abf89dbfb266ee6
SHA256

a4dceef103cbdcd56f031389477bdfca3e1b0ba730d701c94df61a72cd47b31b
SHA512

5457a756fbc6c32141331452b5a3c7c953c5043b7662c041090a464cc75a8ba7addd3ccc3cdcc875be98c27298ece9b7457dacffe85cb516413a876230b22091
SSDEEP

96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7vRCjl:juLJ/oAdQPQa2aeng7I

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1212	2084	rundll32.exe	84
PID 2084 wrote to memory of 1212	2084	rundll32.exe	84
PID 2084 wrote to memory of 1212	2084	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4dceef103cbdcd56f031389477bdfca3e1b0ba730d701c94df61a72cd47b31b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4dceef103cbdcd56f031389477bdfca3e1b0ba730d701c94df61a72cd47b31b.dll,#1
  2⤵
  PID:1212