79e1ccbfdf84436f54902e79d229d4bf0841dbcd825d6a35afe8c25d41c27f3c

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 06:06

Target

79e1ccbfdf84436f54902e79d229d4bf0841dbcd825d6a35afe8c25d41c27f3c.dll
Size

24KB
MD5

5ebd7e4f1fab1dd795ecb8dd90bb10c4
SHA1

ad3e2b33396dd880e42a0c4e9e0078cbcf9fe8cb
SHA256

79e1ccbfdf84436f54902e79d229d4bf0841dbcd825d6a35afe8c25d41c27f3c
SHA512

ebdadce34b10713597eee5a5625cdf675510a7bd81cb33e165e0d402b6e971347cdc23c5d76e297bf6500b9c6247c3233fd456620f6d43d4e652c0fde1d184db
SSDEEP

384:Cwv04S9pZtd3UXGC+8lfBIs4ueqzioe88IccCjl:CwTS9pZtd3UXllfBIs4ueqzioeTI9C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2052	5072	rundll32.exe	83
PID 5072 wrote to memory of 2052	5072	rundll32.exe	83
PID 5072 wrote to memory of 2052	5072	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e1ccbfdf84436f54902e79d229d4bf0841dbcd825d6a35afe8c25d41c27f3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e1ccbfdf84436f54902e79d229d4bf0841dbcd825d6a35afe8c25d41c27f3c.dll,#1
  2⤵
  PID:2052