2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 23:48

Target

2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378.dll
Size

6KB
MD5

b396594b36cd98e478fb0bdff7d07550
SHA1

2ec12e573821761f6a5e8393bd2c451fb1ba5533
SHA256

2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378
SHA512

b6a8dda9fba0bb03372c97489327de6a2571b0f42dc756774c023fd12dcc8200395356b64f85826eb816900402afc76e7343250ffc97fe531eac3dc36763c28e
SSDEEP

48:6tAj5YVOhzVsJCwGhpi//ZAwVmN21SZBbgDq9JkWaZOQBb:jhzVsJzG/c/2RN7MqXraZOQN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4708	4848	rundll32.exe	32
PID 4848 wrote to memory of 4708	4848	rundll32.exe	32
PID 4848 wrote to memory of 4708	4848	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b52ef064af599f6d5df83d1e0f8aabef093107a43efd64c677fdf4a0e5e4378.dll,#1
  2⤵
  PID:4708