5b1f3a2b3e775496043ce158282d72ec40f5abc247bef227605f9f8b383efc8b

Analysis

max time kernel
120s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:26

Target

5b1f3a2b3e775496043ce158282d72ec40f5abc247bef227605f9f8b383efc8b.dll
Size

6KB
MD5

c46fe35e320ca19828958fe9d7221140
SHA1

9699ca11c8bdabbc9fd408a8ef39bec500d8a351
SHA256

5b1f3a2b3e775496043ce158282d72ec40f5abc247bef227605f9f8b383efc8b
SHA512

17c6f139eeca358020c3367b72641123aeb8bbd6fcfcdeb1df5f24965594fc1dc0bbbf4ffc341c9f1c3e09c3c354e55caf4d10b07f36b9710b4b72dee10f568c
SSDEEP

96:nEY2RrF1eqwi4KL1JDm4bN6h2Mdc+gFAnBvacg:EHRh1eppYJDm4bN6h2Mdc+gFAnBScg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4372	4324	rundll32.exe	82
PID 4324 wrote to memory of 4372	4324	rundll32.exe	82
PID 4324 wrote to memory of 4372	4324	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b1f3a2b3e775496043ce158282d72ec40f5abc247bef227605f9f8b383efc8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b1f3a2b3e775496043ce158282d72ec40f5abc247bef227605f9f8b383efc8b.dll,#1
  2⤵
  PID:4372