db5450f3560d1be7992d3820d5cf450a5a7ac5bd270437ffdc3f2334e9c0372b

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 17:16 UTC

Target

db5450f3560d1be7992d3820d5cf450a5a7ac5bd270437ffdc3f2334e9c0372b.dll
Size

66KB
MD5

67a9013ccf2722a2278c65f9369611aa
SHA1

428637d3a849b9e7f73c0f8a5ca05e57d45e3e8e
SHA256

db5450f3560d1be7992d3820d5cf450a5a7ac5bd270437ffdc3f2334e9c0372b
SHA512

b4a9968cf253a030d732c4b548aca3c8a444607727703cf128202c445e42302efa5f929a0fdb85671f88c16587653450f01382f2f42b81bcb349de180a8281a6
SSDEEP

1536:NomNZnI+CQSrNSzr2cgR2vk2csSngRyaYUTN1mplDtaMke0EepRfIfAQpC:NooC+C4r2cgR4BSgz2LYWfZC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 4124	1088	rundll32.exe	82
PID 1088 wrote to memory of 4124	1088	rundll32.exe	82
PID 1088 wrote to memory of 4124	1088	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db5450f3560d1be7992d3820d5cf450a5a7ac5bd270437ffdc3f2334e9c0372b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db5450f3560d1be7992d3820d5cf450a5a7ac5bd270437ffdc3f2334e9c0372b.dll,#1
  2⤵
  PID:4124