753f359d08bf58e08834d45cfcaaf3a29d5c864c3b3f5a4ed8b3f96caf02a373

Analysis

max time kernel
95s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 18:50

Target
753f359d08bf58e08834d45cfcaaf3a29d5c864c3b3f5a4ed8b3f96caf02a373.dll
Size 124KB
Sample221029-xhbjmsbdam
SHA256 753f359d08bf58e08834d45cfcaaf3a29d5c864c3b3f5a4ed8b3f96caf02a373
MD5 5108cafb5750aac2aa72c98c441dd150
SHA1 52cced4396fd232c9fe766d117cba7959253a72d
SHA512 02bdf50776b3544d334332173d274e0b76fad91ff226c3a21cce27bd5cabb4bba773cd9fb0ed7964ecf072d2ef0db3df5e6e9bdb416600a61c484db247ad4357
SSDEEP 3072:rxBTCCNrVphFi0+Ry0BV5JFPQ+L/vHgQFmyDfhfaW:r/rP7i0YX++L/fg2FA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4924	4876	rundll32.exe	82
PID 4876 wrote to memory of 4924	4876	rundll32.exe	82
PID 4876 wrote to memory of 4924	4876	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\753f359d08bf58e08834d45cfcaaf3a29d5c864c3b3f5a4ed8b3f96caf02a373.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\753f359d08bf58e08834d45cfcaaf3a29d5c864c3b3f5a4ed8b3f96caf02a373.dll,#1
  2⤵
  PID:4924