ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:33

Target

ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0.dll
Size

5KB
MD5

d0eca65ae62723100e07fe34d0a9bea0
SHA1

832d7a5c45e6a0dc48c4973c47fccd8f866f556d
SHA256

ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0
SHA512

1bfdf69b66b463d58caf9ee31027174b01d6d1cdc312c9ccdc0cec8b21c5e4e65afef442a4daf2b728a367c9878ffcfaad356c7c43c99b1e2023390c00147c16
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXrAz9zo:1h9jTqMMrY0OI/KYyznSMcZo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 1528	808	rundll32.exe	79
PID 808 wrote to memory of 1528	808	rundll32.exe	79
PID 808 wrote to memory of 1528	808	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef2392a8a4384857fdd9fb00a41daeb5d21f25573dccb5bd55730cd35c276ea0.dll,#1
  2⤵
  PID:1528