a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b

Analysis

max time kernel
145s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 10:01

Target

a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b.dll
Size

18KB
MD5

65fa16830c1978e0071569b9fe453210
SHA1

02bb124f75177a0d1a22df37a1297188e1b6c0db
SHA256

a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b
SHA512

037d0b8c7e9048b9311c31eec90a4674c4a603f7bcdc3bb675f3b3f4fca1b166893f5f5ac2505578420e67071cb00ce7cc70e6906a872836a717a104e003f142
SSDEEP

384:zB7eaC64Zz0skzUmwCrzWIAmUBCiY6IH6zrVRnB7wB9/VV9o0viI89E:zB7e3Z0snmwCWIAgiY6IHGrvGD/n9dv9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 364	4528	rundll32.exe	79
PID 4528 wrote to memory of 364	4528	rundll32.exe	79
PID 4528 wrote to memory of 364	4528	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5ccc5038ff3ed589e78dc4b3b16e56161bf86c895c9a55e62e91d20e471057b.dll,#1
  2⤵
  PID:364

memory/364-133-0x0000000077BA0000-0x0000000077BA6000-memory.dmp

Filesize
24KB

Download
memory/364-134-0x0000000000C00000-0x0000000000C40000-memory.dmp

Filesize
256KB

Download