af55352c35fe4379847037b559306be4f779781a6aea405ff627b507aea6d4c7

Analysis

max time kernel
90s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:57

Target

af55352c35fe4379847037b559306be4f779781a6aea405ff627b507aea6d4c7.dll
Size

854KB
MD5

ae1f96a1ae79a076544df9ae85854860
SHA1

85be3d576a17d84ef6f20abd9f95caf2b0d5ee6e
SHA256

af55352c35fe4379847037b559306be4f779781a6aea405ff627b507aea6d4c7
SHA512

4ebcec4c78d35d769444fad425032207a4288c7636f96f35664e72c2828cbdb2e204ac2eaa05d0a8a58811990a6694d75fbb6ec02c1c308f09863c88d89de96e
SSDEEP

24576:6BzwvMHas8snQC6CMZ0z6WBxaZJM2SuYNuAVQid0Zs:iwvM6y36CM26WBElSuxAmios

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4644	1336	rundll32.exe	81
PID 1336 wrote to memory of 4644	1336	rundll32.exe	81
PID 1336 wrote to memory of 4644	1336	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af55352c35fe4379847037b559306be4f779781a6aea405ff627b507aea6d4c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af55352c35fe4379847037b559306be4f779781a6aea405ff627b507aea6d4c7.dll,#1
  2⤵
  PID:4644

memory/4644-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4644-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4644-138-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download