57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:07

Target

57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542.dll
Size

6KB
MD5

ac58c4dfdb244b2936ea6edf7707c640
SHA1

aafc44fff3f192e45ca7ed53f3570a206a7d8055
SHA256

57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542
SHA512

49fe472f22ba0e78ba2653285a8f0e682ebc2e5e878a5548693d2523c385d7edf07144179564f76e00dc768f9b1c056eb1c2acd5f64545618c1d70943defa80d
SSDEEP

96:nI2RrUeqnFvjny4v63JZobBIXf9i4vgP/bKZoIa+/GWF9K:XR4eD/50BE9inP/0N9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 432	3092	rundll32.exe	81
PID 3092 wrote to memory of 432	3092	rundll32.exe	81
PID 3092 wrote to memory of 432	3092	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57da8eee2ca9f522ddc9d2fe2d9b8cc63129ecc514096ba4c8af978b2ec24542.dll,#1
  2⤵
  PID:432