c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0

Analysis

max time kernel
80s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 01:56

Target

c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0.dll
Size

36KB
MD5

8b6d73c8dbfd4234abe407cdfca186a0
SHA1

2e321e34e93aa18fcee25156a08ec9e3a29e59c2
SHA256

c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0
SHA512

8278e6a4e251e5687a149396ceb05f10fb7bff8aad91c17327bfbbeda55c06b08ea1a0f7d8254c059dcec8095195b4b57ff473f0a60a72ace1f50fbb7e83303f
SSDEEP

768:hldjeazLJ73PSindj9tuVqFqH7Pdvlr5hCD8ROgx:hjjeUJ73PRtuVq67F9lQgROy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2044	4984	rundll32.exe	81
PID 4984 wrote to memory of 2044	4984	rundll32.exe	81
PID 4984 wrote to memory of 2044	4984	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d04affea003b6e5b23561379a1ff376a7284a7804d087dbcb32202030b86e0.dll,#1
  2⤵
  PID:2044