5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:57

Target

5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac.dll
Size

6KB
MD5

8395cbc74f64b89ac8c506229d6b85d0
SHA1

0f26be30ba662cf25e9dc01fdf27196bd6b9c9f2
SHA256

5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac
SHA512

94092071fa699978c9341ac4205eb1ac31789060ae7634e3b98d0d2034027483aeb16557a6c8630c9acac3b183e88080a3087bc9612467b70bdeabb1b7cb633a
SSDEEP

96:nEY2RrF1eqwi4ajrry68ctUlZm70XYhNxI6EqcfrNRcCqrmr5s:EHRh1eppdusonaBDN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2232	1368	rundll32.exe	81
PID 1368 wrote to memory of 2232	1368	rundll32.exe	81
PID 1368 wrote to memory of 2232	1368	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a274d75b33d5256c529cf666daa6a0c4e5ad7dab02ee58c579152a9e3411bac.dll,#1
  2⤵
  PID:2232