5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415

Analysis

max time kernel
166s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:04

Target

5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415.dll
Size

445KB
MD5

2f0bea008100f461a6ec023d190ee710
SHA1

538e31f27d0889359410628cc67390c28a6f6d03
SHA256

5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415
SHA512

284c3306f3b567dfd4c9f8063f7f8751863c8c249a868f3f0ab0abd06182eac4d55de4e7e1d7992faff3c9da33ec04b9c88f7f498b046ea5bfdbf76abecbbd7a
SSDEEP

6144:N4Xr3nR6t8gbCCeglCeskyLwIcJ5puCOuF+53IykoNCDbRuNLdkzaE4:NE9glC3kwwIcJCCrdo8o5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2656	2220	rundll32.exe	78
PID 2220 wrote to memory of 2656	2220	rundll32.exe	78
PID 2220 wrote to memory of 2656	2220	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bf4e707471992b965402b0f3f51405eedd87e260ff3bb2a7fed4680e0557415.dll,#1
  2⤵
  PID:2656

memory/2656-133-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download