b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7

Analysis

max time kernel
95s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 16:45

Target

b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7.dll
Size

5KB
MD5

610fae4df9197f66f33212846a1b157b
SHA1

1540c403072d9f9e88b0a5651e6159610b91fbde
SHA256

b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7
SHA512

136d37e4cd6cbb543f10141fcf545597cb1d22bb34ca669385925afd4bf74fc8876ff7edb0ae48e0f32932c0f4194852dfe9415d5db38e41d8510f5dc1e4a085
SSDEEP

96:nEY2RrF1eqwi4qnFS0MIF6h2oxGlwSnTB68YFjX:EHRh1epp0FSP2oxGlwMB6pFr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3752	220	rundll32.exe	84
PID 220 wrote to memory of 3752	220	rundll32.exe	84
PID 220 wrote to memory of 3752	220	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83a5fd6beaf99f421ec483e4542f8f6141a03a84d8e888cc29a35da81120bc7.dll,#1
  2⤵
  PID:3752