5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592

Analysis

max time kernel
164s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 00:27

Target

5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592.dll
Size

6KB
MD5

163fbb4ccabaf5cd24ad13aa4f87c6d0
SHA1

d70a35b2e2c24d135c1318f2cef00d190bc08b79
SHA256

5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592
SHA512

8d569fd07424bf294abd3e281c083e90ab52a327cbe016b568f967d42b91251ee81d73d320874f06d2e2f64b800dfb32f3439c0248babac21389f1e655a199b5
SSDEEP

96:PIV9yIjhsZrg0j6I/AhWNijWmNLfEC43sIDS0L79:PyIIjWXGhqNQLcC48IDS039

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1692	4556	rundll32.exe	80
PID 4556 wrote to memory of 1692	4556	rundll32.exe	80
PID 4556 wrote to memory of 1692	4556	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d60f8bade7e92924e2373b5e1b26bdfcc704ff488d8c12e10b31996c39ad592.dll,#1
  2⤵
  PID:1692