b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b

Analysis

max time kernel
91s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2022 01:35

Target

b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b.dll
Size

401KB
MD5

54aec528621286ab0e62f02d08f8d911
SHA1

02e463479c07b889f5f88605b174cff0ebffebc2
SHA256

b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b
SHA512

763e95c2d349225e6465f86d858d17d0222a56ee1b5c12c8e405b7670dadc59ae40328558bfc6a6aec10cc1fcc372fa2874e325dc1c38783194b22cdb798d2eb
SSDEEP

6144:AGpUsW+mjJfO0b+VMeZJUlR9wxTDS3nrmm8fxVG8iTzE:B7T0MZgCs8a8eE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4060	4376	rundll32.exe	82
PID 4376 wrote to memory of 4060	4376	rundll32.exe	82
PID 4376 wrote to memory of 4060	4376	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b95b427bf339bbab4f4d4d2de9acb114cc41d5ab85efbb6def8a9bb8cd7c522b.dll,#1
  2⤵
  PID:4060