52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:10

Target

52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll
Size

6KB
MD5

7f2f9e13bec52fc8af9fe9f454052390
SHA1

6126ab911b52377c709c2206320a5c0a40821162
SHA256

52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573
SHA512

e196e0cf8b6b59e6db1d220b9c25b1fe4bd9d0ad07b88f2610c2c05b360014cacd8bc86452f0eac9871920baf77a040fc2ad2af539652d383c35f2e6a84b4843
SSDEEP

96:ng92nrwQ0eqnOxk6nTsuxD2R5RL9TAF7h/j7kC69CXut4/KAahxwm2fjMk:/neeRtn7l25tuhHmAX1KAwxwlf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4248	2220	rundll32.exe	79
PID 2220 wrote to memory of 4248	2220	rundll32.exe	79
PID 2220 wrote to memory of 4248	2220	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll,#1
  2⤵
  PID:4248