bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720

Analysis

max time kernel
87s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 15:53

Target

bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720.dll
Size

6KB
MD5

0d3b8c98dd19c197c5c8ab6c40a23260
SHA1

b67db530ee59cc6c41d1d53d06e6267810e2d44c
SHA256

bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720
SHA512

748ea7d4cb185cad3f753e0cc78f19b26d3f046e0f32cb7e843f629ad4fe861675d6cfdf6b7bc12a02c8526868ea4d032363bbf7380e87f38c9722c9f65ef411
SSDEEP

96:z0/gPtJrYmVjGwd+8blPDDDDDDDDEZSIs23AteE1SjuS8x:FTiS+siZQ23AteEkjuS8x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3536	3736	rundll32.exe	82
PID 3736 wrote to memory of 3536	3736	rundll32.exe	82
PID 3736 wrote to memory of 3536	3736	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb5b7738aedfd32c6aced4077fa2088ba3b3f862ee7bb7e6f7f4bdc8cffdb720.dll,#1
  2⤵
  PID:3536