2aa50b97a99dfb35a927ecf40a385ed4d02408b12df282a37c2b5289203b6ebc

Analysis

max time kernel
45s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 10:44

Target

2aa50b97a99dfb35a927ecf40a385ed4d02408b12df282a37c2b5289203b6ebc.dll
Size

70KB
MD5

3f9f4e9301adfc89762b1374dab2c100
SHA1

1f3e3d108c44e527a58357ef6d74625f6ffbaaca
SHA256

2aa50b97a99dfb35a927ecf40a385ed4d02408b12df282a37c2b5289203b6ebc
SHA512

dbf6b3482d29492a62435f5de44b0575683b9699503e10b7b7615487a4c32bba685459792e74a6c0ff1af87a4c5cce63ee1e3b674e3eb8e19ee792f45fcd7a19
SSDEEP

1536:rppzLd1gSeJ+w30dE1UTRILnAgI9uErs9jz0RUHm7INk:VxduSeJ+wEhFILAuEgjwRUHmk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1552	3744	rundll32.exe	81
PID 3744 wrote to memory of 1552	3744	rundll32.exe	81
PID 3744 wrote to memory of 1552	3744	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa50b97a99dfb35a927ecf40a385ed4d02408b12df282a37c2b5289203b6ebc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa50b97a99dfb35a927ecf40a385ed4d02408b12df282a37c2b5289203b6ebc.dll,#1
  2⤵
  PID:1552