51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:48

Target

51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554.dll
Size

54KB
MD5

1a0f8ad10e7e952993e08a1e3f918cd2
SHA1

425a9d62e8b61a0de10dd150832e3eb5e0e6016c
SHA256

51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554
SHA512

0104aec94436b73bc6f6a2c6065daab9d8c22565fb18901264270b191a643642ea0d50fb1d943ca0c46355ddf1af9732df6ce54bccbedb7af1082b7c3714e65b
SSDEEP

768:eEf58XQOIw+9p6GTkhL5lO31nadzIUUTPEcRTDbeRQhpawapFmfMDvVqyR0QoKui:7k8760y2c4TEcRreRw0wwvVqyaUu1lrW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4316	4880	rundll32.exe	81
PID 4880 wrote to memory of 4316	4880	rundll32.exe	81
PID 4880 wrote to memory of 4316	4880	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51535f8ddb6b51ebba18bf8155c0375889450aa1fd9e1b7b4a147c61e96a8554.dll,#1
  2⤵
  PID:4316