ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19

Analysis

max time kernel
155s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 10:52

Target

ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19.dll
Size

363KB
MD5

0da87308be82a1ff563735a689dc5ea0
SHA1

5b0d07d6808574e1f5893e282d05fcaf34c88cd4
SHA256

ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19
SHA512

b5a703c28f74fc094524e440e109a2a5d11dd4691865c1edc955ddc3e9cf39b5be76b1e34cadee2aa81240350e7c27e6da0547f1e82d8966653eeec221b7c901
SSDEEP

6144:0qPkHbjSrvGh1Jvfz45O7IBDjpT4F2v6nw1VFbdC3e3l5K0xcUrIs/xl+TytMEiC:0qPkHPiOf2pUYCnwnFbBl5nxbkSEwOIX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4380	2092	rundll32.exe	79
PID 2092 wrote to memory of 4380	2092	rundll32.exe	79
PID 2092 wrote to memory of 4380	2092	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba704323b21d57d6bb74b06ae0e1b64e85ec86105afb05fdb1e756ecce86ed19.dll,#1
  2⤵
  PID:4380