a61d7b8c19dd04c6b8fe7ae153d24cb20b539ec9c1e2eb6dddd3ab3a7a359f86

Analysis

max time kernel
77s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 00:46

Target

a61d7b8c19dd04c6b8fe7ae153d24cb20b539ec9c1e2eb6dddd3ab3a7a359f86.dll
Size

5KB
MD5

32818c735bc9f76643ea6aecb1a120b0
SHA1

09f2b97f35c9a223495d830b25cee1099f1a9821
SHA256

a61d7b8c19dd04c6b8fe7ae153d24cb20b539ec9c1e2eb6dddd3ab3a7a359f86
SHA512

b199ed94b60aee9c4fc494776b72528bd824559fa66d809221cd1f475449758200d9027f1f173a10650df5610fbb6e161f4642469701de0e1ed8b90779e5ba68
SSDEEP

96:nEY2RrF1eqwi4ka3UswBZbrnd9dTbuwy3/s8q7a+SEamGM:EHRh1epp33SBZbLdvbuwyk8q7a13

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 940	960	rundll32.exe	80
PID 960 wrote to memory of 940	960	rundll32.exe	80
PID 960 wrote to memory of 940	960	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a61d7b8c19dd04c6b8fe7ae153d24cb20b539ec9c1e2eb6dddd3ab3a7a359f86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a61d7b8c19dd04c6b8fe7ae153d24cb20b539ec9c1e2eb6dddd3ab3a7a359f86.dll,#1
  2⤵
  PID:940