ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955

Analysis

max time kernel
113s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 18:34

Target

ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll
Size

5KB
MD5

074441de2ca21471ace199a60c0eeeaa
SHA1

e76c68595d0ce814e94533784fd2c486a407f87e
SHA256

ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955
SHA512

f6371d38745d736ffb08c1921210c260e10ad20149ee9dec66a48769671820d69246b1697767ef5a2b8132a3c9bd4376db1eb1de2623484e6b06caa4d78a293a
SSDEEP

96:qT+ZKXI71G6Ezj1fzVbMIsv28nM5Y14pmWH1:qKkaGnxVbMIWnD14pnH1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4872	3936	rundll32.exe	82
PID 3936 wrote to memory of 4872	3936	rundll32.exe	82
PID 3936 wrote to memory of 4872	3936	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba36cfff628dba392d0d7f1c5041ce9ca99becaac9110371a9eee64962ce7955.dll,#1
  2⤵
  PID:4872