af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:55

Target

af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110.dll
Size

4KB
MD5

74683a4ab466486fc783a09f7a9e8b10
SHA1

0ac53d97ef29995b032cca0308d10132f0f3246c
SHA256

af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110
SHA512

ddc8368a9fbf38362f3c2b3970be148a38f40182fc1cdb57526ecafdf4464e84d4874e0ad0f1faa9e00483e5650e29bf06dfddcd01d0b76999b3f6b7a106c282
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mmGgB4ydH9P1O:PmkiIz8UZrQ0MhI/ITqly9XO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4848	4948	rundll32.exe	28
PID 4948 wrote to memory of 4848	4948	rundll32.exe	28
PID 4948 wrote to memory of 4848	4948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af9fa7317d444ec970dad70b92700b9fc4606b426d60d2850e09cb523ac56110.dll,#1
  2⤵
  PID:4848