f2a9482b496726d15caba7c7433d381690e870934da33eb7db4cf8763e49c768

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 11:42

Target

f2a9482b496726d15caba7c7433d381690e870934da33eb7db4cf8763e49c768.dll
Size

17KB
MD5

7afdc7bad85d71020d59501e9c8a3133
SHA1

543de30e22b7460247638ff7fd42fe6d238f067a
SHA256

f2a9482b496726d15caba7c7433d381690e870934da33eb7db4cf8763e49c768
SHA512

c6815b66449b16c3cedbe4ea41ba06f163e721c9b913616d04b525d48501aacefc38f70cc78a6cbfe8c36e889f1e035be007703b4caccbec7167f1e7570c5076
SSDEEP

384:BaBzKTmYYpkiwCm+7fdTn4BQJUt6brpwM+m5zRqNUJ4i1:IKSpwsV4OmYbP+m5zpJ4i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1508	4960	rundll32.exe	82
PID 4960 wrote to memory of 1508	4960	rundll32.exe	82
PID 4960 wrote to memory of 1508	4960	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2a9482b496726d15caba7c7433d381690e870934da33eb7db4cf8763e49c768.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2a9482b496726d15caba7c7433d381690e870934da33eb7db4cf8763e49c768.dll,#1
  2⤵
  PID:1508