2f5d28ad144113993d69a9b03e38e9f8bd3143a08ac7e1ffb8de80bb782a7d24

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 16:51

Target

2f5d28ad144113993d69a9b03e38e9f8bd3143a08ac7e1ffb8de80bb782a7d24.dll
Size

18KB
MD5

bff1fd40ade73ca4502469161a2d2440
SHA1

65308369eb017bea0c9c557d5fdd8f82e2f45d59
SHA256

2f5d28ad144113993d69a9b03e38e9f8bd3143a08ac7e1ffb8de80bb782a7d24
SHA512

2c68e398a338deaf31877c35bd78c80bfb7328358f710d93932e28ee18feb9518b20d9af504750ab92ad20e4e096e68b3371d5acdecfcf19d519f0e22453d053
SSDEEP

384:4rDKFb+tnPWjtLf8zv57/wBQvJZgo0vivV+Mf:kqatnPWjtLfo7YOvHgdv+VTf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 3044	848	rundll32.exe	82
PID 848 wrote to memory of 3044	848	rundll32.exe	82
PID 848 wrote to memory of 3044	848	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f5d28ad144113993d69a9b03e38e9f8bd3143a08ac7e1ffb8de80bb782a7d24.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f5d28ad144113993d69a9b03e38e9f8bd3143a08ac7e1ffb8de80bb782a7d24.dll,#1
  2⤵
  PID:3044