de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 00:58

Target

de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1.dll
Size

7KB
MD5

7131c877c42a71e34451d3ca424ca7a0
SHA1

1add473ee9663ef02549a89c74f007a4ed02da85
SHA256

de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1
SHA512

d892ca150bd01f7b8e4c5f9f7856bf7cc863d70cfbd8bc36132b6789b5e375d93317827400969bd32f8a9fbdf570d36af862894ca5900fcf1b954bc6274263a6
SSDEEP

96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniRO1Hj2gLNYEdWD8PEvl2:YXQbp3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4396	4872	rundll32.exe	80
PID 4872 wrote to memory of 4396	4872	rundll32.exe	80
PID 4872 wrote to memory of 4396	4872	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de50b51daf4ef0b8e2810abd21ae0a4d76246a6091a1be5892690be1a03e4da1.dll,#1
  2⤵
  PID:4396