af1d6c94d632fba867071852f5a8dc5479c37521a680e4bd87f16a1e50b0d589

Analysis

max time kernel
153s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 13:35

Target

af1d6c94d632fba867071852f5a8dc5479c37521a680e4bd87f16a1e50b0d589.dll
Size

1.1MB
MD5

51e1b27251544ea31537877a63f18359
SHA1

595106acd1fac45d97bd990a9f30fe7b16e29800
SHA256

af1d6c94d632fba867071852f5a8dc5479c37521a680e4bd87f16a1e50b0d589
SHA512

f23a85ae42755bafd81a2946c7a7fe5d8b0f70b293eba8c92d7353d3552e090feb13a409f5bd78dbafaec05137db95ff33bf431954a6bc0c9044feb7eb2c95e5
SSDEEP

12288:7XKtl3NHhwXMGBfIXRkSSFbKKQKBmQNmTid:AR5iXzgXREFbRBmS2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4308	2220	rundll32.exe	80
PID 2220 wrote to memory of 4308	2220	rundll32.exe	80
PID 2220 wrote to memory of 4308	2220	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af1d6c94d632fba867071852f5a8dc5479c37521a680e4bd87f16a1e50b0d589.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af1d6c94d632fba867071852f5a8dc5479c37521a680e4bd87f16a1e50b0d589.dll,#1
  2⤵
  PID:4308