5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3

Analysis

max time kernel
190s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:47

Target

5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3.dll
Size

48KB
MD5

3933a49fc55c4db6f2410db3789ec4d0
SHA1

82447e78eec71d1104ea6b292289f8c44e01fba3
SHA256

5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3
SHA512

0339994bae875d1dc0aeec270b2ed1541c6cbbb9657674d0bc13a1faa6a035b02aabac9b79d56095d82ebc6bfcda83beb540bddd09e51b317907c1aec6c45a58
SSDEEP

768:LgNTT4aHr3BH7zX7S5aWR6HF3hLP2FXKIuuzwJ:LgxXIaWoHFNP2cIu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1616	2148	rundll32.exe	83
PID 2148 wrote to memory of 1616	2148	rundll32.exe	83
PID 2148 wrote to memory of 1616	2148	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ced168a8122ba90ac1e173a4db2e9798afb1c8136ac0876b5936a65b6a9c3e3.dll,#1
  2⤵
  PID:1616