c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a

Analysis

max time kernel
159s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 01:57

Target

c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a.dll
Size

6KB
MD5

5e196d2b855cb281bedbe4f56859b610
SHA1

5b95797191a7660dc2c95cc53eaad47b365a9757
SHA256

c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a
SHA512

79ad48142c1b8f30fa00eb60142f4b5bb10ff59a7f6e2ba485c5159e558f58f132d561a4df32c5780e8b8a9896e9603dcd3122c8f3a6ecee7077ed6854cb0b21
SSDEEP

96:WLRxkjujtjd8jPjcZG2UoGd3vdtsfpEyBSk7nr/7IJ:WtqKR6bgYI8nKpEyBJv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4332	4284	rundll32.exe	81
PID 4284 wrote to memory of 4332	4284	rundll32.exe	81
PID 4284 wrote to memory of 4332	4284	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5a586dff6093aab35545f31baf518f72f31bd94085dc40bc945e90478b4b02a.dll,#1
  2⤵
  PID:4332