d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c

Analysis

max time kernel
209s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:44

Target

d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c.dll
Size

49KB
MD5

5af910ea274a620f8cfae5ad673a9712
SHA1

41cd6f0ec800ae719010669d9174a95a38ccdd12
SHA256

d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c
SHA512

cfda0d7fca6813dc40cc800edaaf055731804b6b66fcb277aa44bf45bf23c85fd5ccf50db026cfa90e228536198655f478b05998d93dcb87eadfea7a8fcb2d52
SSDEEP

768:nbY4lC0ZU+0+fljdCtfgz2BFo78q9Y2PjLLtlxRL8PKgl0:EGjSUljdCtfId8qC2P/LtFL8Pm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 1656	4808	rundll32.exe	82
PID 4808 wrote to memory of 1656	4808	rundll32.exe	82
PID 4808 wrote to memory of 1656	4808	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5fc30bc18edc999b24df299635bba011a3aeaa30ac5a864725a24f7c875c05c.dll,#1
  2⤵
  PID:1656