d0aaf301ce03576d7670becc0bb6707dd0ab8eff8c9dcd3f3f93768fd0463792

Analysis

max time kernel
357s
max time network
503s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:07

Target
d0aaf301ce03576d7670becc0bb6707dd0ab8eff8c9dcd3f3f93768fd0463792.dll
Size 9KB
Sample221204-ael5mshe55
SHA256 d0aaf301ce03576d7670becc0bb6707dd0ab8eff8c9dcd3f3f93768fd0463792
MD5 010ad2bd360b5e0fb98d541c2615f790
SHA1 fecc03ed0cc37e219ecd19bb07efef0f3811b663
SHA512 8ab37d612c0104d525c6b1c3134cc70452718f4987fabaa0431fdd8c88d35b83771a1309d86646e8a0bf02f693f52c8dff25c9c6ff966dd0b8f8a3a2d2060be4
SSDEEP 192:Enekfu3hME1hMEuCv/ENbSrbFzCcyssPPP7eDPHnx7IqtjI0:EneCMhME1hMEuCv/ENbSF9yDzebHx7dn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2564	4640	rundll32.exe	79
PID 4640 wrote to memory of 2564	4640	rundll32.exe	79
PID 4640 wrote to memory of 2564	4640	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0aaf301ce03576d7670becc0bb6707dd0ab8eff8c9dcd3f3f93768fd0463792.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0aaf301ce03576d7670becc0bb6707dd0ab8eff8c9dcd3f3f93768fd0463792.dll,#1
  2⤵
  PID:2564