2f2117c86ef073a35e730ffa0b847da1e1adef67433bd01367bc294ba7aa3bdc

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 18:18

Target

2f2117c86ef073a35e730ffa0b847da1e1adef67433bd01367bc294ba7aa3bdc.dll
Size

16KB
MD5

ad23c4c6b1972e21a75938e1a6dd5d00
SHA1

1ec15e9f4c0d56b26dd0f3af7205ac8a4d366409
SHA256

2f2117c86ef073a35e730ffa0b847da1e1adef67433bd01367bc294ba7aa3bdc
SHA512

96af879c5096fa1ababa3db15f094554af936340eaa3c96ab41b719965f413b05195db3a2c714b379446a5cb3330d65607f5a7848484733c8b6b644697f13978
SSDEEP

384:Myib7PSTPO2k5gkPtt5I7USxcGMGRLA9KYs0xfWcDloo4Y:MyibeTm2k5fVnIoUTMELLYsSW6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 5000	4956	rundll32.exe	19
PID 4956 wrote to memory of 5000	4956	rundll32.exe	19
PID 4956 wrote to memory of 5000	4956	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2117c86ef073a35e730ffa0b847da1e1adef67433bd01367bc294ba7aa3bdc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f2117c86ef073a35e730ffa0b847da1e1adef67433bd01367bc294ba7aa3bdc.dll,#1
  2⤵
  PID:5000