0aa2e123b884ffcabda352a70e104c28cbb99f91cd3e0f9087397afb4e934930

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 18:31

Target

0aa2e123b884ffcabda352a70e104c28cbb99f91cd3e0f9087397afb4e934930.dll
Size

5KB
MD5

2125996b3c1773406dba450db3008789
SHA1

135b5bc30ab431f263fbea7bfa1a3fc90683ce60
SHA256

0aa2e123b884ffcabda352a70e104c28cbb99f91cd3e0f9087397afb4e934930
SHA512

6ffb58bd8968151513f06c28209a9b16da9361f34d21318449c8055ce5d01d3567d66fd9667b154187781e8d6bc7366d9d678811fbed0f86a62643920413b2f9
SSDEEP

96:nEY2RrF1eqwi4R9GsJSatrMTrbt1hXRer2u19W3Q4f3H:EHRh1eppR9GsJSatrMT/BXReiWW3Q4f3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4796	4688	rundll32.exe	82
PID 4688 wrote to memory of 4796	4688	rundll32.exe	82
PID 4688 wrote to memory of 4796	4688	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0aa2e123b884ffcabda352a70e104c28cbb99f91cd3e0f9087397afb4e934930.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0aa2e123b884ffcabda352a70e104c28cbb99f91cd3e0f9087397afb4e934930.dll,#1
  2⤵
  PID:4796