a00f4ab81060dd46efdf7bb10c70cfc136a7acb651ab30370c5c4ebc4559e921

Analysis

max time kernel
185s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 20:46

Target

a00f4ab81060dd46efdf7bb10c70cfc136a7acb651ab30370c5c4ebc4559e921.dll
Size

55KB
MD5

3d81d33a44be44d4eb2ae6b29cbfac0b
SHA1

3f1bc0550fb9f5037f32b23678b707e1d85e984b
SHA256

a00f4ab81060dd46efdf7bb10c70cfc136a7acb651ab30370c5c4ebc4559e921
SHA512

0fd3f3295cd3c9709f791b21c653744f8dd58b650f3b593009461dc20c41477b50519440fde3e879056c57c9e88f46c5f0923d9c80469e1f819891a0a2490b00
SSDEEP

768:VPdibYWC3/9Hie2nfsxcHMfgcvOxn0tRyC2iUdNJc1rEZZxmp+G2p:/oqlHiLnfsxqMocEnwgJOI62

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4748	4788	rundll32.exe	79
PID 4788 wrote to memory of 4748	4788	rundll32.exe	79
PID 4788 wrote to memory of 4748	4788	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a00f4ab81060dd46efdf7bb10c70cfc136a7acb651ab30370c5c4ebc4559e921.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a00f4ab81060dd46efdf7bb10c70cfc136a7acb651ab30370c5c4ebc4559e921.dll,#1
  2⤵
  PID:4748