b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:53

Target

b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df.dll
Size

5KB
MD5

99b49f026ce4dcfda46676aa4e1ebcb0
SHA1

0a1fe1a258c00fcb7c2b2cf4a12a8a8bf271f162
SHA256

b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df
SHA512

219cc2c44ce12c444a67a4a94d941d2b92c0184ae3edc0541e622a3abe043a4e8c071658368fc41443f24366ddb12b1da3e41d419a7f57495e23bea07eb6e0c1
SSDEEP

96:REDi6iiGIaXowjJj8KE7milmQ1k6GsvvV0DB5UVMecB27xocy4BH:RE+a1eSK+VSDcmFuxmi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81
PID 4656 wrote to memory of 4860	4656	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8e9c95040548a53e7f8089686c548feb83f3857f61e977508959e84e52107df.dll,#1
  2⤵
  PID:4860