92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78

Analysis

max time kernel
168s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:39

Target

92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78.dll
Size

332KB
MD5

1132b53168c3687b8583d155dfa2d77a
SHA1

08b4fac1af1799efb9121b49170eb032ce46cead
SHA256

92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78
SHA512

a4c570c03d6a6085f848f1d8d7d8c733a169acaa0261345abc841690e9e880eccde6cb6665612d506f4b327dc2246648c834405264abcb53ebd98043a3f73098
SSDEEP

6144:keMSB+bSPNqYx1tgyY7fR5hWCvorsatRVF/beTx4OCsmD7y+HhHeNBQ0Vw5:kpSecqKgzZ7atd0NDey+2BQ2w5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2952 wrote to memory of 1704	2952	rundll32.exe	rundll32.exe
PID 2952 wrote to memory of 1704	2952	rundll32.exe	rundll32.exe
PID 2952 wrote to memory of 1704	2952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92c5ffef9f5ab165aa4441395cd518b5fd8094bc6b231eca782b88ea3c488d78.dll,#1
2⤵
PID:1704