af96af76ef2e8edc7edb72b074f1439b7ea0fa2b5be27115e5c5d7c41c51efd5

Analysis

max time kernel
155s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 21:23

Target

af96af76ef2e8edc7edb72b074f1439b7ea0fa2b5be27115e5c5d7c41c51efd5.dll
Size

34KB
MD5

5de71f35410bd6358e77b891248358c0
SHA1

74615f99e9e924d3f6594657dd0fc7a6142e0556
SHA256

af96af76ef2e8edc7edb72b074f1439b7ea0fa2b5be27115e5c5d7c41c51efd5
SHA512

6208b26de9619c0a47a9bf73dd6432e62e43c5b164caeb9b584b1c7a428d4cdb71a61360a094611ed38aee9426acfd75c207fbacfb5d64a43b01718e2de54f36
SSDEEP

768:l7tXGKqr8zXfaLtzxI7rQimiNf5hqD1DRCbtrvqP:l79GCfaL47rQipkxRmtrvqP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1132	4556	rundll32.exe	83
PID 4556 wrote to memory of 1132	4556	rundll32.exe	83
PID 4556 wrote to memory of 1132	4556	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af96af76ef2e8edc7edb72b074f1439b7ea0fa2b5be27115e5c5d7c41c51efd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af96af76ef2e8edc7edb72b074f1439b7ea0fa2b5be27115e5c5d7c41c51efd5.dll,#1
  2⤵
  PID:1132