e052052924302d2b95d5e8f79395ac57dbe772352057efc60379068173f392c5

Analysis

max time kernel
82s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 12:01

Target

e052052924302d2b95d5e8f79395ac57dbe772352057efc60379068173f392c5.dll
Size

872KB
MD5

129d27953e4de05a2c3954fd4c4c3410
SHA1

fbdbf269eb2dbe17a5a3c2b277a580c59ef5bc35
SHA256

e052052924302d2b95d5e8f79395ac57dbe772352057efc60379068173f392c5
SHA512

45a4cead434f2ae0fa1aca88d5818a9e4f60cd3cf32029bfefd9e174d7cd775397ca2a966481c49348e5a6b328a21f107c61cd696ca51053ab3a2bf334c36619
SSDEEP

12288:LuKLTHl1H79VUF+0HNOs8c4vOg1dlSpUiKGAodqweo/cCS:xHl1H79VUFbHsw4vOgd4UiKGF1c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 5004	1140	rundll32.exe	69
PID 1140 wrote to memory of 5004	1140	rundll32.exe	69
PID 1140 wrote to memory of 5004	1140	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e052052924302d2b95d5e8f79395ac57dbe772352057efc60379068173f392c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e052052924302d2b95d5e8f79395ac57dbe772352057efc60379068173f392c5.dll,#1
  2⤵
  PID:5004

memory/5004-133-0x0000000010000000-0x00000000100E0000-memory.dmp

Filesize
896KB

Download