a76cc2b60c268eb8acf6c0980e69cf7024d7044575db4f5a130e55dc75509495

Analysis

max time kernel
185s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:11

Target

a76cc2b60c268eb8acf6c0980e69cf7024d7044575db4f5a130e55dc75509495.dll
Size

7KB
MD5

dc29c0d37b98b129f000c369f484b020
SHA1

a702c65c115f6f14f40d11563c0a5a44c29e4761
SHA256

a76cc2b60c268eb8acf6c0980e69cf7024d7044575db4f5a130e55dc75509495
SHA512

d4545b41deeccd88fa69d3c98b0487f454297d2a14be17d6b17bfecde229caf2ed73de4686ff353653897599be29d31a5870e8e07cfd48e2c3477e2e5b5601ce
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROKWGYX6X31w3YpBtG8phDC+OVT4nz:YX8r8wo3pw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4752	4784	rundll32.exe	48
PID 4784 wrote to memory of 4752	4784	rundll32.exe	48
PID 4784 wrote to memory of 4752	4784	rundll32.exe	48

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a76cc2b60c268eb8acf6c0980e69cf7024d7044575db4f5a130e55dc75509495.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a76cc2b60c268eb8acf6c0980e69cf7024d7044575db4f5a130e55dc75509495.dll,#1
  2⤵
  PID:4752