bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e

Analysis

max time kernel
187s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 07:08

Target

bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e.dll
Size

25KB
MD5

63909d2b3b4248538df414a4afea7fb0
SHA1

aaa12db599d60220da536524fb6a2aa4b5d176d0
SHA256

bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e
SHA512

07a2d711ad41ee716f58f6892d343d5f03a236579f686fffaed69cbdccb6177187f4e98ed5439250543cedd9138759a29b3056b9d9f3af020f9158d0bf94499b
SSDEEP

384:nGhNz35E7duta+fGGq77nRrFglQWY6awzjRcfE:nGfz3u7duta+Rq7lrFGQZ6hzjReE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4704	4768	rundll32.exe	78
PID 4768 wrote to memory of 4704	4768	rundll32.exe	78
PID 4768 wrote to memory of 4704	4768	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf559b7ff4cf7cbe9e43b97b8e250304952cc530e22efd723d0d77afd48a9b3e.dll,#1
  2⤵
  PID:4704