a5be46858bdc1829f9b99edd31261213d4e1c1fdf660a7810e0bc3fc4940bcff

Analysis

max time kernel
144s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 13:54

Target

a5be46858bdc1829f9b99edd31261213d4e1c1fdf660a7810e0bc3fc4940bcff.dll
Size

131KB
MD5

4633c8fe12b07741a618209f70a1d1f0
SHA1

5a785068817d2912f70ced041d3a52bbd15d3142
SHA256

a5be46858bdc1829f9b99edd31261213d4e1c1fdf660a7810e0bc3fc4940bcff
SHA512

8037430f97e40c352c34db66ab64a5b850eaa395aae87866991b11603454733e17cf6b333f407128784f1eddb8d332b2800a31097028858c7f7dfb316f3a2f4b
SSDEEP

3072:JQkzUD/q1iB1x5Ydux/ky4lUAOA64focq6A2/IZgQ2:JpzU7LB1x5Yduxs1Rgcq6AKI2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2272	1596	rundll32.exe	81
PID 1596 wrote to memory of 2272	1596	rundll32.exe	81
PID 1596 wrote to memory of 2272	1596	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5be46858bdc1829f9b99edd31261213d4e1c1fdf660a7810e0bc3fc4940bcff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5be46858bdc1829f9b99edd31261213d4e1c1fdf660a7810e0bc3fc4940bcff.dll,#1
  2⤵
  PID:2272