5753aba8ec25f362c03ef2df92f5ab0105bcb4ac66db9d0dd59dc8b245c55822

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 16:41

Target

5753aba8ec25f362c03ef2df92f5ab0105bcb4ac66db9d0dd59dc8b245c55822.dll
Size

90KB
MD5

8248f7a234d92bf65b9048cd63dad6cb
SHA1

432957345d86908d7d94cdc9cc53196595deb4dc
SHA256

5753aba8ec25f362c03ef2df92f5ab0105bcb4ac66db9d0dd59dc8b245c55822
SHA512

93087c327793f8697a38a3c764891dd77cdcfef0cf97424027a416b44e2b5c3a8cd1079041d48fdf931a62eeca5b9982f2f1c95b6b7be65c60007e09afef44c1
SSDEEP

1536:QPHd2owFn+G5mAGHnWau10k3WCxfe4yXaB991fKbKO9YITBSbmaE:QP9hwdmPnWdLWCxfpyqBDFOz9TSbrE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4604	4444	rundll32.exe	78
PID 4444 wrote to memory of 4604	4444	rundll32.exe	78
PID 4444 wrote to memory of 4604	4444	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5753aba8ec25f362c03ef2df92f5ab0105bcb4ac66db9d0dd59dc8b245c55822.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5753aba8ec25f362c03ef2df92f5ab0105bcb4ac66db9d0dd59dc8b245c55822.dll,#1
  2⤵
  PID:4604