b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b

Analysis

max time kernel
149s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 19:01

Target

b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll
Size

20KB
MD5

064ee2886b29169b78956133017c8736
SHA1

91c5c6e65356bd94c18e4ea540aa24d84f080d12
SHA256

b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b
SHA512

ad3665d21a58c008ad78a853811afd2843db8c7c1b05ca336d74639073e86737845c17a5ccd2ded951a749215cddf7bd5bd4a274d240a4c2c08d14250fa4878d
SSDEEP

384:E8e/FlJnjG7mmpPdEizc1Tus9mViVaVBVqVd+Ve+VqVE1:UF3njE1biTutUcvYWts

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3740	4088	rundll32.exe	79
PID 4088 wrote to memory of 3740	4088	rundll32.exe	79
PID 4088 wrote to memory of 3740	4088	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5601678e5d9d247830d468d3e9000ba36be45dd9822d2754753803a48e6750b.dll,#1
  2⤵
  PID:3740