562305b392c0c5383d1f660d5e99403f93ab4ff49638e33019f62d9d99cdc07a

Analysis

max time kernel
227s
max time network
252s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:08

Target

562305b392c0c5383d1f660d5e99403f93ab4ff49638e33019f62d9d99cdc07a.dll
Size

7KB
MD5

9f5accb2d2b2031a8ec2b0a8526caaf0
SHA1

be3a592325262ebb6d53bd4a05bf3755bfb617c6
SHA256

562305b392c0c5383d1f660d5e99403f93ab4ff49638e33019f62d9d99cdc07a
SHA512

e7977a72d3e0392e3cfde7c231c43e3ff1e11874e15a33b0ae54ad1c5a8c2b04b3b2a8c95d8e57ac685f244071c3a49672badf7332f313c3eb0ed5e46e7652ef
SSDEEP

96:z0xgPtJrYmVjGwd+Ub9LQAFzZ9/SrXK21RWSWxusgZhZa:nTiS+EFVFZ9/YXJ1PsMZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2680	3332	rundll32.exe	81
PID 3332 wrote to memory of 2680	3332	rundll32.exe	81
PID 3332 wrote to memory of 2680	3332	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\562305b392c0c5383d1f660d5e99403f93ab4ff49638e33019f62d9d99cdc07a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\562305b392c0c5383d1f660d5e99403f93ab4ff49638e33019f62d9d99cdc07a.dll,#1
  2⤵
  PID:2680