14c55f530c10025e8fe64ba39e3d1f2494d89f5a325947f2dde94517d5348d55

Analysis

max time kernel
91s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:57

Target

14c55f530c10025e8fe64ba39e3d1f2494d89f5a325947f2dde94517d5348d55.dll
Size

4KB
MD5

e19b9307d50d9ecdada5f972f68abe60
SHA1

cc32c988f491f17880772bb53e7971dcce475995
SHA256

14c55f530c10025e8fe64ba39e3d1f2494d89f5a325947f2dde94517d5348d55
SHA512

5b5f132e9ca52df5caeee1217de7a60674818b518521c06a57aeea530c603f10d4f865b0414552f56354128a7a5a051c5e7f48974e26051b42a146e94938e365
SSDEEP

48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mm9KZaN4M:PmkiIz8UZrQ0MhI/ITqly9KEN4M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4932	1556	rundll32.exe	80
PID 1556 wrote to memory of 4932	1556	rundll32.exe	80
PID 1556 wrote to memory of 4932	1556	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14c55f530c10025e8fe64ba39e3d1f2494d89f5a325947f2dde94517d5348d55.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14c55f530c10025e8fe64ba39e3d1f2494d89f5a325947f2dde94517d5348d55.dll,#1
  2⤵
  PID:4932