5da256cf9d2d455d5ca9a8777bee778f88a0e6c090d6a9009658429e1b87c655

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 04:09

Target

5da256cf9d2d455d5ca9a8777bee778f88a0e6c090d6a9009658429e1b87c655.dll
Size

32KB
MD5

6b346434ff0b9c26480803b3ca76f094
SHA1

3f53aa582d0ab48d69ac8d6a02650437af79d85a
SHA256

5da256cf9d2d455d5ca9a8777bee778f88a0e6c090d6a9009658429e1b87c655
SHA512

3ce5535e721bc5951e9ec03b4b58b24a3b8462f751200963cec3e88ff4f05bfba70b00097c40f3f608e305b3d5c6833c58a2f47cb0a2c28f1b86b42ef27aebbf
SSDEEP

768:+t+NP27D6a8deklv/LT7PlhXlK9VfShVfLRBQ2I7:+t+p272es/7PlhVK3aHDRU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2556	1108	rundll32.exe	83
PID 1108 wrote to memory of 2556	1108	rundll32.exe	83
PID 1108 wrote to memory of 2556	1108	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5da256cf9d2d455d5ca9a8777bee778f88a0e6c090d6a9009658429e1b87c655.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5da256cf9d2d455d5ca9a8777bee778f88a0e6c090d6a9009658429e1b87c655.dll,#1
  2⤵
  PID:2556