c5903e8437346987b86e593a327426691a78fb0ec5f97233e9466facc8a58135

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 11:16

Target

c5903e8437346987b86e593a327426691a78fb0ec5f97233e9466facc8a58135.dll
Size

22KB
MD5

e405b458933089aff09350cb7df59fa4
SHA1

6f31eb618ce7c600fc717d3871b1d0d4a0fbf3b9
SHA256

c5903e8437346987b86e593a327426691a78fb0ec5f97233e9466facc8a58135
SHA512

b09ad10b5e7f5100ff8d7faf2a41581b7c6dd7c70a1c0717195dac748bd84d556c0f4961c3ab3cd603d0e0dcbd750d63163ed633cacb71a31cf73a84c9ce02c8
SSDEEP

384:39WnKqzoSEi1hMEruqFvJS7Dq4fetjJ8kGDnpXD:AK9LgfKiS7Dq4fCjTcND

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4252	4772	rundll32.exe	81
PID 4772 wrote to memory of 4252	4772	rundll32.exe	81
PID 4772 wrote to memory of 4252	4772	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5903e8437346987b86e593a327426691a78fb0ec5f97233e9466facc8a58135.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5903e8437346987b86e593a327426691a78fb0ec5f97233e9466facc8a58135.dll,#1
  2⤵
  PID:4252