55a9bf08207026ba47a4528cc15f7f54427610e015a0c23e1a035833367fb78a

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 07:41

Target

55a9bf08207026ba47a4528cc15f7f54427610e015a0c23e1a035833367fb78a.dll
Size

94KB
MD5

4b171a348d3062d72c162e9c7e8f6d35
SHA1

a1733c833882f2cb828fa666c302387fc247e960
SHA256

55a9bf08207026ba47a4528cc15f7f54427610e015a0c23e1a035833367fb78a
SHA512

814043451b5583044e07b734880ae9135cc5b561b66a188f4d2cd2b84cdc1115d6a3703d819db45b3f736961f8ca5dccb0870e345e177246a7315cf4866eed60
SSDEEP

1536:2moLIIWdNE9jv4LsBgIbXCAGA4LdDzV72UP63oQemFwcPl3nMCi29h1L:f2RWdNEp4Ls2gX/GACV72k63DeglcCiE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 3236	868	rundll32.exe	82
PID 868 wrote to memory of 3236	868	rundll32.exe	82
PID 868 wrote to memory of 3236	868	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55a9bf08207026ba47a4528cc15f7f54427610e015a0c23e1a035833367fb78a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55a9bf08207026ba47a4528cc15f7f54427610e015a0c23e1a035833367fb78a.dll,#1
  2⤵
  PID:3236