a2e9fedbcb1d048e8d2106d1b5c4320719d2a6a13246dc5a133fd7cb8dccdb32

Analysis

max time kernel
98s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 10:46

Target

a2e9fedbcb1d048e8d2106d1b5c4320719d2a6a13246dc5a133fd7cb8dccdb32.dll
Size

404KB
MD5

44fbd6dda283b559bdcb5c698b25c7a0
SHA1

09e2794bc6bcdb42d11bd5fe05c551d2bd3ddc81
SHA256

a2e9fedbcb1d048e8d2106d1b5c4320719d2a6a13246dc5a133fd7cb8dccdb32
SHA512

dc418d47c1c3502ab53fa4e72d2987488666cec25258e443b864a475e950aec2a673b85608ea56216fab39f13f8ea7221fe46cb187d37a574a2750d316700dd3
SSDEEP

3072:/mYRV+2cMP0MjLXdZWinEkT3TiXVVCqIcgyLvriU1h+/qr2CEV:/mYRVDT73XdZWf0DUVNgyLzR1hVE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1304	4500	rundll32.exe	85
PID 4500 wrote to memory of 1304	4500	rundll32.exe	85
PID 4500 wrote to memory of 1304	4500	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2e9fedbcb1d048e8d2106d1b5c4320719d2a6a13246dc5a133fd7cb8dccdb32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2e9fedbcb1d048e8d2106d1b5c4320719d2a6a13246dc5a133fd7cb8dccdb32.dll,#1
  2⤵
  PID:1304