543de2760dc655a0f45a26bd368b2410f77935235769e8b7e54934a0b3015320

Analysis

max time kernel
90s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:16

Target

543de2760dc655a0f45a26bd368b2410f77935235769e8b7e54934a0b3015320.dll
Size

6KB
MD5

3ceb8e56477c2f59344c6ed5ddf056b0
SHA1

5ab6355564320b5a037a0a610c7ceaf259ea121f
SHA256

543de2760dc655a0f45a26bd368b2410f77935235769e8b7e54934a0b3015320
SHA512

0937798e2c53fab63f3c259d4ad642da1c6cc5a5e8f4689ddfc0249d4b6be1563b92a41d4232dfc48a013ceede04f44b375875cfae0ce4445f47abf295dce99a
SSDEEP

96:VGEETrMLH5jduJPJmtuxmOkfX00OW6+CEhDWzqvgW:efMoCOcjVvgW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4972	4868	rundll32.exe	81
PID 4868 wrote to memory of 4972	4868	rundll32.exe	81
PID 4868 wrote to memory of 4972	4868	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\543de2760dc655a0f45a26bd368b2410f77935235769e8b7e54934a0b3015320.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\543de2760dc655a0f45a26bd368b2410f77935235769e8b7e54934a0b3015320.dll,#1
  2⤵
  PID:4972