559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 18:38

Target

559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819.dll
Size

142KB
MD5

5b4b8a0a4c4a8da5bcba1f29f5d9e578
SHA1

87d6c3638c8365c666adfe69ca7477da4a241b43
SHA256

559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819
SHA512

3478e680d93aa4d6f50b3db47b5dd91316573633cd4b1c37d9a8e8bd78124b6da6bb578e820d6e57539d89780e6cdbb67155f9d0ee14fc13b005914a85f2e895
SSDEEP

3072:KG4SNpL0ymEgn3G5vY8dc1C4xXXfHs0ySe7yVyWr0z8gsC:K5SNpXmEgn32vYWc4IHfySCy/r0z8E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3420	1508	rundll32.exe	81
PID 1508 wrote to memory of 3420	1508	rundll32.exe	81
PID 1508 wrote to memory of 3420	1508	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\559a85917df66a9cc856d1b70328c80875566a3e64bf7cce80aa040ec4e3b819.dll,#1
  2⤵
  PID:3420