eb55d6287cf5df85e20225c4baf46d9c5e75f3f1f6149d5f9c932156e79d2de4

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:07

Target

eb55d6287cf5df85e20225c4baf46d9c5e75f3f1f6149d5f9c932156e79d2de4.dll
Size

5KB
MD5

94574ee383bd7f95f62cd363620721a0
SHA1

e53558a6130ca783b109e4d03bef17561e42b206
SHA256

eb55d6287cf5df85e20225c4baf46d9c5e75f3f1f6149d5f9c932156e79d2de4
SHA512

1540019c35a39bc761163de17ce9b78c06a6555c5240082a51074bb7821f0c3c8ed23450378ffde9d3839556108191baef8447e2e189d17467284a0412021d25
SSDEEP

96:nI2RrUeqjblrtO/aetn8J6tWAcFrTDv6vIj55Zj:XR4e+bl1tDv15

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1664	1956	rundll32.exe	82
PID 1956 wrote to memory of 1664	1956	rundll32.exe	82
PID 1956 wrote to memory of 1664	1956	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb55d6287cf5df85e20225c4baf46d9c5e75f3f1f6149d5f9c932156e79d2de4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb55d6287cf5df85e20225c4baf46d9c5e75f3f1f6149d5f9c932156e79d2de4.dll,#1
  2⤵
  PID:1664