b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0

Analysis

max time kernel
242s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 22:01

Target

b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0.dll
Size

31KB
MD5

7a9a8fd7fc3b406194e58f39e7720010
SHA1

5538596379d0a46c1f0c17a29b7b1cade982e7d2
SHA256

b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0
SHA512

7b7914fc9a048c799857ed077c3ab6a5c4e624243e437f44a7b00661e23df46a2b55503637939bb62e45532a350b3dcda5093fe430d000742c67a19b32ce8585
SSDEEP

768:qYJWA1CqWe0PamHQ267tM/AChqDERIE8vB:vkA1kPamM7tEhkYRIE8Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5084	1812	rundll32.exe	80
PID 1812 wrote to memory of 5084	1812	rundll32.exe	80
PID 1812 wrote to memory of 5084	1812	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5c523ea22653e2669c7588f3f52ef2afd2a96586719831ca3f2040c02f347d0.dll,#1
  2⤵
  PID:5084