54af4386edac8513527e3cf50aa40054385ce03cd663e37a652f686ccb51bba3

Analysis

max time kernel
176s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 14:55

Target

54af4386edac8513527e3cf50aa40054385ce03cd663e37a652f686ccb51bba3.dll
Size

13KB
MD5

0ef16bd94c7d49289d7c9d59e7b4aa20
SHA1

ed00d40e6be845baa521b2749c0b171a444dc12c
SHA256

54af4386edac8513527e3cf50aa40054385ce03cd663e37a652f686ccb51bba3
SHA512

711fb93769b39a5ac74e4541eb77cac15f5f606ebacbc2bc8fb6cf47e7995cd9bd35412f20b524ffc2524ad6135e0604725eae6112da637b1f68c8c6974cea6f
SSDEEP

192:dD0GY9E4y1EiWDUcCk1BFisjQ/kKnWE0bcZyL:TqEd24k1ziKunWEby

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 3032	2732	rundll32.exe	79
PID 2732 wrote to memory of 3032	2732	rundll32.exe	79
PID 2732 wrote to memory of 3032	2732	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54af4386edac8513527e3cf50aa40054385ce03cd663e37a652f686ccb51bba3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\54af4386edac8513527e3cf50aa40054385ce03cd663e37a652f686ccb51bba3.dll,#1
  2⤵
  PID:3032