561c5cf281595afaff1b34a2ce32ffd8482efd6ddbed88af2391fb639b74a54c

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 20:49

Target

561c5cf281595afaff1b34a2ce32ffd8482efd6ddbed88af2391fb639b74a54c.dll
Size

77KB
MD5

a06976e4240606f97ba8b0e23bf736a0
SHA1

14a0f63e9a245e0abaa8c44f070cee95ef6901f7
SHA256

561c5cf281595afaff1b34a2ce32ffd8482efd6ddbed88af2391fb639b74a54c
SHA512

5b3f21b3de852b1d6cbfb7df95b26fefcc5b4391b77e10ca8f84e385a527691371971336ee18176781d284228912a68b607ec0b2fc7c287c12f8d3321cebb2ca
SSDEEP

1536:ccWmsuL8yN4xoi0AcR73fc8vsWjcduXi0qB:9WUAJaQuXiDB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4952	1372	rundll32.exe	83
PID 1372 wrote to memory of 4952	1372	rundll32.exe	83
PID 1372 wrote to memory of 4952	1372	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\561c5cf281595afaff1b34a2ce32ffd8482efd6ddbed88af2391fb639b74a54c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\561c5cf281595afaff1b34a2ce32ffd8482efd6ddbed88af2391fb639b74a54c.dll,#1
  2⤵
  PID:4952