0d57cf81e9e8e27d74e197d1d3896b49dcbe29233f8dfec638f48e0ea2f5b4c2

Analysis

max time kernel
160s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 04:25

Target
0d57cf81e9e8e27d74e197d1d3896b49dcbe29233f8dfec638f48e0ea2f5b4c2.dll
Size 54KB
Sample221021-e1yg1sbhe7
SHA256 0d57cf81e9e8e27d74e197d1d3896b49dcbe29233f8dfec638f48e0ea2f5b4c2
MD5 63f8784b53f6c51bd53e26cc10dc85d2
SHA1 25ed83f59a3b80337ae5e5d0300cf371ed2ad6e0
SHA512 e4b88655bb71da98a6cfe440d70c8f0b887a03c4a70c641a17c0030cacac585dbe237bead4aeb3f5918dd44f9930c9d84b12783788043564e5f93529375fae6a
SSDEEP 768:yuUr3ip/IHI7NQTvqRxjj7hj5E/fDP4WgNFDbNzxRWCw5Y6XJF9+3vfEKjpb9Ll5:yl3E0TYxjQ7PRmDbXRvYY6V+Xljpb97
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4896	5072	rundll32.exe	78
PID 5072 wrote to memory of 4896	5072	rundll32.exe	78
PID 5072 wrote to memory of 4896	5072	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d57cf81e9e8e27d74e197d1d3896b49dcbe29233f8dfec638f48e0ea2f5b4c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d57cf81e9e8e27d74e197d1d3896b49dcbe29233f8dfec638f48e0ea2f5b4c2.dll,#1
  2⤵
  PID:4896