ba51ef109581250f8c65d942127554a2aa244139fc108efc250ecdeaeeaf41ec

Analysis

max time kernel
193s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:44

Target

ba51ef109581250f8c65d942127554a2aa244139fc108efc250ecdeaeeaf41ec.dll
Size

62KB
MD5

4cf869b610209091ccc246a2db03a8a0
SHA1

ad9abe8a879e774b50f27e8d0883d8458e9e1b87
SHA256

ba51ef109581250f8c65d942127554a2aa244139fc108efc250ecdeaeeaf41ec
SHA512

d3d38f45f03642dfccc198f2ba2670d5e1d7f20d96272c1701e3f994f915ea368e3a5e0a1ca232a1b07ab63278c21522c4c4cbbb696116a049505601c98570b7
SSDEEP

1536:5JdPaYfW1dJjIQm3O79yH3YyDUfA1HbtnZnt69N+:5JdPaYfGJjIQme7YIaUwbtnZnt69Q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 4716	964	rundll32.exe	79
PID 964 wrote to memory of 4716	964	rundll32.exe	79
PID 964 wrote to memory of 4716	964	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba51ef109581250f8c65d942127554a2aa244139fc108efc250ecdeaeeaf41ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba51ef109581250f8c65d942127554a2aa244139fc108efc250ecdeaeeaf41ec.dll,#1
  2⤵
  PID:4716