bef850fac7612d85d2472c05fee938a94989e87cab2b3c3ea07c1f7617d87c3f

Analysis

max time kernel
148s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:11

Target
bef850fac7612d85d2472c05fee938a94989e87cab2b3c3ea07c1f7617d87c3f.dll
Size 156KB
Sample221205-pcsa7scg4t
SHA256 bef850fac7612d85d2472c05fee938a94989e87cab2b3c3ea07c1f7617d87c3f
MD5 42730a153ba047ab3a8a584d619a0059
SHA1 1fd044259eba65d2b385a176ff772ce593f9f874
SHA512 1617ab53eb2609fc2801c47a8b97d5371a6c0266ee5844bdd3dc0ab988f8008441f9f4f96e10a3a87fc8a80b07301701d12058dcc6946997fa9e97be1f3f7b9c
SSDEEP 3072:k7X0eLimQoUTKwJEthf+0aguAPJ6e8mr:2EJ6f+0aLAge
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4388	952	rundll32.exe	80
PID 952 wrote to memory of 4388	952	rundll32.exe	80
PID 952 wrote to memory of 4388	952	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bef850fac7612d85d2472c05fee938a94989e87cab2b3c3ea07c1f7617d87c3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bef850fac7612d85d2472c05fee938a94989e87cab2b3c3ea07c1f7617d87c3f.dll,#1
  2⤵
  PID:4388