5fdfb1006289ceac72672452009dbd96ec05780ea1dfcf1299e6959493cd75a8

Analysis

max time kernel
166s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:40

Target

5fdfb1006289ceac72672452009dbd96ec05780ea1dfcf1299e6959493cd75a8.dll
Size

2.2MB
MD5

88e2a37041a0a8e3afe468d42e222966
SHA1

1eaac534401e3cc6058115190b03c5568458c18a
SHA256

5fdfb1006289ceac72672452009dbd96ec05780ea1dfcf1299e6959493cd75a8
SHA512

f8c605630df451ca184ac587dd2f4e60d077a189fa57c07294ae798318b81ae3ac76d43b09bf9a42c153f349750a2e73a53d7494c592f2adfd58ef56737bbe95
SSDEEP

49152:u44HppuzGxHHY4L2q5HkL+eUYWHsiJNXvkUKm/FPdGuHCGeQCr:TG/uzGNV9HkAVHL/DKmFfCVQS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 992	1628	rundll32.exe	81
PID 1628 wrote to memory of 992	1628	rundll32.exe	81
PID 1628 wrote to memory of 992	1628	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fdfb1006289ceac72672452009dbd96ec05780ea1dfcf1299e6959493cd75a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fdfb1006289ceac72672452009dbd96ec05780ea1dfcf1299e6959493cd75a8.dll,#1
  2⤵
  PID:992