5f8128bf913af64fc8de537afc157b907d87faa3a0b550e9b8f3f5bc4234e666

Analysis

max time kernel
148s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 13:54

Target

5f8128bf913af64fc8de537afc157b907d87faa3a0b550e9b8f3f5bc4234e666.dll
Size

10KB
MD5

a16d3d3e9cfd0ee17fac668ec92e73e3
SHA1

afe522a67eadd4675cbed81fc08f8732c94baf58
SHA256

5f8128bf913af64fc8de537afc157b907d87faa3a0b550e9b8f3f5bc4234e666
SHA512

22c025e35cc4a16e90edf381ca9ac3fa52fa39747d0223f6439758d1e8032df41c0da1edba00d8d66eca17337b9c87b81eb286490ca2803b8e4f1c91e271a6bc
SSDEEP

192:Sw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w92b:6dHad/N20IypWak8dWiWak8EdW7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 1576	460	rundll32.exe	81
PID 460 wrote to memory of 1576	460	rundll32.exe	81
PID 460 wrote to memory of 1576	460	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f8128bf913af64fc8de537afc157b907d87faa3a0b550e9b8f3f5bc4234e666.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f8128bf913af64fc8de537afc157b907d87faa3a0b550e9b8f3f5bc4234e666.dll,#1
  2⤵
  PID:1576

memory/1576-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download
memory/1576-134-0x000000006DD20000-0x000000006DD27000-memory.dmp

Filesize
28KB

Download