ce54d55bfbf704473c438c9ec18c8e7618fcac23feda54f65d4a3bdc8833972d

Analysis

max time kernel
144s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:47 UTC

Target

ce54d55bfbf704473c438c9ec18c8e7618fcac23feda54f65d4a3bdc8833972d.dll
Size

5KB
MD5

8352345cc481fc320ed2328206dee2b0
SHA1

6511d1a4564732fdae06392933cae4cd6c9ba6c9
SHA256

ce54d55bfbf704473c438c9ec18c8e7618fcac23feda54f65d4a3bdc8833972d
SHA512

25c6c32dd1bdb88a9f4263d39ae69fed7197a03326784ef3a726b350b87823a023f2b709db0285c93edb7b0cc4fcc206c127bc0da9fbc40c32cbb2945fd7b258
SSDEEP

96:nEY2RrF1eqwi4S9puALcW+egLYTtvcIU5Jj7n8HzjC7d:EHRh1epp49LcWxg+tUH/LSvCx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4512	1540	rundll32.exe	79
PID 1540 wrote to memory of 4512	1540	rundll32.exe	79
PID 1540 wrote to memory of 4512	1540	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce54d55bfbf704473c438c9ec18c8e7618fcac23feda54f65d4a3bdc8833972d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce54d55bfbf704473c438c9ec18c8e7618fcac23feda54f65d4a3bdc8833972d.dll,#1
  2⤵
  PID:4512