5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c

Analysis

max time kernel
239s
max time network
259s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 03:19

Target

5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c.dll
Size

72KB
MD5

5b46792ce15c0b165352d84a1be10520
SHA1

243188005b69aa43ca5f34818a94b8c77f57e792
SHA256

5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c
SHA512

af373cb3aba76e6e540d3bfab29bd8d69a14d33909fb5db2234dec3ae0941d260d4fa4e0ccb62e3267a7f68a9b520efdd3a6afae4eca1b69e0d4a05a413b6b45
SSDEEP

1536:yHZjwYOryu+gJxpWJHHeah7jql8A39KrHCJTZZp8:yHFDYJxyHh2CwZp8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 32	3456	rundll32.exe	79
PID 3456 wrote to memory of 32	3456	rundll32.exe	79
PID 3456 wrote to memory of 32	3456	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa535767c06cd06095e321797364c350c646a65c6e8d461934427e8999dd72c.dll,#1
  2⤵
  PID:32