bcaf19fc274ae58dc30e8deba2153c30d6f028d92480333a77a78429b0b15af5

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 14:40

Target

bcaf19fc274ae58dc30e8deba2153c30d6f028d92480333a77a78429b0b15af5.dll
Size

52KB
MD5

04973d96bfd0c0daa19ff212bd92997d
SHA1

77f29bf11193b594c42f3d6b6869eb09204cffba
SHA256

bcaf19fc274ae58dc30e8deba2153c30d6f028d92480333a77a78429b0b15af5
SHA512

bcfb2182bf6ede9cde2b71863c5892b0a5c83e60ceb676461d93ae1866d45bdc96e4b31c012ce36f4a9fba41b916d3a8bd3260eba9e657eb3b18e3e3670ec0bb
SSDEEP

768:2788TBHR7oOj33NvwSFbyx9GGB8oYMW3NX:2788TBHldxtbAcLoTW3l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1568	4712	rundll32.exe	79
PID 4712 wrote to memory of 1568	4712	rundll32.exe	79
PID 4712 wrote to memory of 1568	4712	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcaf19fc274ae58dc30e8deba2153c30d6f028d92480333a77a78429b0b15af5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcaf19fc274ae58dc30e8deba2153c30d6f028d92480333a77a78429b0b15af5.dll,#1
  2⤵
  PID:1568