a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:11

Target

a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9.dll
Size

5KB
MD5

d3067312f1b3888055f1480b22f24730
SHA1

24f5747874117702db73ba0f9d6154f9166e8c37
SHA256

a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9
SHA512

011895fcaa9857f10eaac97b674e2c772b63f50d57729942f9f4fecbeaf4bf3176c6811a370b0388e47393c18fd264eefe2c7bd53106897617f8923f0e44cb25
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiVi:XUcA+ggd+W/If0ii

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1108	3836	rundll32.exe	76
PID 3836 wrote to memory of 1108	3836	rundll32.exe	76
PID 3836 wrote to memory of 1108	3836	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5baff3a7394c09b8173cf24f446f5298f718d962c5d52433b4dc038472f3ae9.dll,#1
  2⤵
  PID:1108