b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20

Analysis

max time kernel
164s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 14:31

Target

b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20.dll
Size

105KB
MD5

edf51f31a003a410b3ca9ce9b59dd6da
SHA1

c1bd2b4df928e3a9237c29df44371cec17532a62
SHA256

b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20
SHA512

e52fb761645126e89a373595ef90eedbf8a277952e4e8b5663553526913c880891b107a5d2b888bed5625481830b139cd84d8bf9414c5689b9c042583488230e
SSDEEP

3072:f/+7/X74Y0m4qaO9B7XUThcjoeBALkkawPGKHAxWBQdZNcZo:f/+7vupqNZjDBAoB6GKgxWWi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 960	3896	rundll32.exe	79
PID 3896 wrote to memory of 960	3896	rundll32.exe	79
PID 3896 wrote to memory of 960	3896	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e5f835376a8729e5b65de994690800df8b5530c50befba0a5fec80a5c7ae20.dll,#1
  2⤵
  PID:960

memory/960-133-0x0000000002780000-0x000000000278F000-memory.dmp

Filesize
60KB

Download
memory/960-134-0x00000000027A0000-0x00000000027BD000-memory.dmp

Filesize
116KB

Download
memory/960-138-0x0000000002780000-0x000000000278F000-memory.dmp

Filesize
60KB

Download
memory/960-139-0x0000000002780000-0x000000000278F000-memory.dmp

Filesize
60KB

Download