2ba2e7117204032d69f2f3e91ba7f0687b7d6f55a51060f07f48833e86a10350

Analysis

max time kernel
153s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:24

Target

2ba2e7117204032d69f2f3e91ba7f0687b7d6f55a51060f07f48833e86a10350.dll
Size

6KB
MD5

d438f12249a8d75d4c53298b81dca5a0
SHA1

c89795fa11c955e8f1f7ebd488b6856d871974c0
SHA256

2ba2e7117204032d69f2f3e91ba7f0687b7d6f55a51060f07f48833e86a10350
SHA512

402f3725005ec5d69dc9cedd8b254470e625a2a688019cf07142f73848d84d436d2454791b3d58b9170edea0dd901f502a3af52ae48c8fcf63deb72060b3bc43
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7fnf:nGTWJGp0UZUd6378snt7fnf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1948	5056	rundll32.exe	84
PID 5056 wrote to memory of 1948	5056	rundll32.exe	84
PID 5056 wrote to memory of 1948	5056	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ba2e7117204032d69f2f3e91ba7f0687b7d6f55a51060f07f48833e86a10350.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ba2e7117204032d69f2f3e91ba7f0687b7d6f55a51060f07f48833e86a10350.dll,#1
  2⤵
  PID:1948