a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89

Analysis

max time kernel
62s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 09:35

Target

a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89.dll
Size

14KB
MD5

3a2a85ff59762a65c39f3c88d0dc2e20
SHA1

9e91d02e3f8e48c098f33825dd216aaf0b70a09f
SHA256

a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89
SHA512

0c133cdf2253bfe25cce9150a1f78f89447196988323d088e554f4b4a5ebe2f92a21752113d904dac7a411256d0cd4218b08d88add5fbe24d883da3094f880c3
SSDEEP

192:aqQsndq08FEahMy1iJoWj6L6k0NVPaIzUOAbn7RqWsNWP2U:RkFEaJOoKUu//xAbn7RqWsNWp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4396	400	rundll32.exe	82
PID 400 wrote to memory of 4396	400	rundll32.exe	82
PID 400 wrote to memory of 4396	400	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f09054968fdd427d3e941ac18845f13c374fe0d014e7b363ba4d7f4b04cb89.dll,#1
  2⤵
  PID:4396

memory/4396-133-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download