afa288360b0866af6f726fc6aa75d7b613d0411265ed0a557a9c6e388913e8af

Analysis

max time kernel
69s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 02:02

Target

afa288360b0866af6f726fc6aa75d7b613d0411265ed0a557a9c6e388913e8af.dll
Size

32KB
MD5

bc3af2e718d917775789c09396e3cb85
SHA1

b36522ade33c472d1642106f10521461a845cf85
SHA256

afa288360b0866af6f726fc6aa75d7b613d0411265ed0a557a9c6e388913e8af
SHA512

1a641c2cacebef6cb9362fed011813e3ac6d2588d6d83db403b64a074e07cd4b9ba350fc3d3acfdb53f3aa8c8f6a7b2b8569960d22138999120f4bcbb9e02e7f
SSDEEP

768:iIh6p/HSZlfvKppbJ17vyfrxOVOGKLRqMjGf:D6pNppj7afryERqMjGf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1972	1368	rundll32.exe	84
PID 1368 wrote to memory of 1972	1368	rundll32.exe	84
PID 1368 wrote to memory of 1972	1368	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afa288360b0866af6f726fc6aa75d7b613d0411265ed0a557a9c6e388913e8af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\afa288360b0866af6f726fc6aa75d7b613d0411265ed0a557a9c6e388913e8af.dll,#1
  2⤵
  PID:1972