5ace22b149be6c5d5f51dfaef9091dc38997e6aadb19e99d156565cbcd4f0420

Analysis

max time kernel
111s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 08:48

Target

5ace22b149be6c5d5f51dfaef9091dc38997e6aadb19e99d156565cbcd4f0420.dll
Size

88KB
MD5

4f441be19a6dd99f1870b0db41be1d33
SHA1

0dfc12c2953664d9718a2b0fe033e9247478f875
SHA256

5ace22b149be6c5d5f51dfaef9091dc38997e6aadb19e99d156565cbcd4f0420
SHA512

dda518d31c32207d60452f938580eb35681f70fe3472097df4065ea8eb191a489f6e93c0e5622f472caf6caa406d7ac90a939f2a62e07df1026d5b5b3463892d
SSDEEP

1536:jt+xVKz+tjjibQRmNWYjA0tp2014Peq5U1pqGdvJivvp2ImC0u:jCwz+tnHYZ00Mf6eGniXgImM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4816	2920	rundll32.exe	82
PID 2920 wrote to memory of 4816	2920	rundll32.exe	82
PID 2920 wrote to memory of 4816	2920	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ace22b149be6c5d5f51dfaef9091dc38997e6aadb19e99d156565cbcd4f0420.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ace22b149be6c5d5f51dfaef9091dc38997e6aadb19e99d156565cbcd4f0420.dll,#1
  2⤵
  PID:4816