54fb8151a042423153fcebb274fc6f907ac190e6508855b8d78b7372f79fa254

Analysis

max time kernel
135s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:01

Target

54fb8151a042423153fcebb274fc6f907ac190e6508855b8d78b7372f79fa254.dll
Size

4KB
MD5

9c2c9bd203f852c099462f2e9ec96bc0
SHA1

f5bcd08947f4763a734cac0a403ed33d213ccac7
SHA256

54fb8151a042423153fcebb274fc6f907ac190e6508855b8d78b7372f79fa254
SHA512

f0753261b8da768303e26cf8cae6a5f444aa3938742449bfe96d1d5b1b186f0622d3b0f5cf38c9f3a3c8767a977abf1b2e73ba1fa03710c8020e31e7876feeea
SSDEEP

48:a5zjMTGcITBVQVE1lckLFTDPhpYpBbqiPH:iT3Qu8kLFTbhuBmaH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2752	4324	rundll32.exe	80
PID 4324 wrote to memory of 2752	4324	rundll32.exe	80
PID 4324 wrote to memory of 2752	4324	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54fb8151a042423153fcebb274fc6f907ac190e6508855b8d78b7372f79fa254.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\54fb8151a042423153fcebb274fc6f907ac190e6508855b8d78b7372f79fa254.dll,#1
  2⤵
  PID:2752