5c2b32c2bb684069237b98bf4ff589ec80d87bbc937ab0cfd3aa4a4b77e2b949

Analysis

max time kernel
93s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 03:52

Target

5c2b32c2bb684069237b98bf4ff589ec80d87bbc937ab0cfd3aa4a4b77e2b949.dll
Size

101KB
MD5

1354060fcf7bc39eabbde62ca96fd295
SHA1

cdf98c13075eb36624d35ab41f5d4727059f3f87
SHA256

5c2b32c2bb684069237b98bf4ff589ec80d87bbc937ab0cfd3aa4a4b77e2b949
SHA512

4264a140a1e854425a275453b71cd33c46c809ad421ec8e5732cd1a1d28121d99fe4492b17c8dc9826f79d9e243113294533b80b1eaf958a306c3e0bc5869a78
SSDEEP

3072:azPF9//eS92TOJ1tyo84Beoh2Ag+mvdx4PZ:Mv/2W2GAo8P02AglreZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2124	1180	rundll32.exe	81
PID 1180 wrote to memory of 2124	1180	rundll32.exe	81
PID 1180 wrote to memory of 2124	1180	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c2b32c2bb684069237b98bf4ff589ec80d87bbc937ab0cfd3aa4a4b77e2b949.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c2b32c2bb684069237b98bf4ff589ec80d87bbc937ab0cfd3aa4a4b77e2b949.dll,#1
  2⤵
  PID:2124