05bca9d49907044f442b3b37be6e44ad88dabe9518b9059bc423131adca9f523

Analysis

max time kernel
263s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:55

Target

05bca9d49907044f442b3b37be6e44ad88dabe9518b9059bc423131adca9f523.dll
Size

33KB
MD5

89b65363c762bdf7c9beb93c4ddb15e0
SHA1

4164bac638c1e336d4392855e9d7332291e44591
SHA256

05bca9d49907044f442b3b37be6e44ad88dabe9518b9059bc423131adca9f523
SHA512

4ce6e6a25addc357639e6cfb9bb886a6ab750394a15a88b0bae521927c6cd7e4bd65354c8973a09ab7ff1ec3a00445cc7c58c111bdf6c2da5929c704ff4a977d
SSDEEP

768:wSn1bTS2JZHNZCyxpzm7N6X7Lfdhh5hcD/4s+pR3zS2TkET:wSn1bTSypSu7LFhzC8s+pRjIY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 1920	3124	rundll32.exe	80
PID 3124 wrote to memory of 1920	3124	rundll32.exe	80
PID 3124 wrote to memory of 1920	3124	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05bca9d49907044f442b3b37be6e44ad88dabe9518b9059bc423131adca9f523.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05bca9d49907044f442b3b37be6e44ad88dabe9518b9059bc423131adca9f523.dll,#1
  2⤵
  PID:1920