b81def52ca42f03eac29aa175d01b7db46985430612e0a4c2982472cecc0f542

Analysis

max time kernel
164s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 01:07

Target

b81def52ca42f03eac29aa175d01b7db46985430612e0a4c2982472cecc0f542.dll
Size

5KB
MD5

1a87396be0911829fb572061342932d0
SHA1

1f1193a8e53d9ffdcce0ced30f9991939290dd41
SHA256

b81def52ca42f03eac29aa175d01b7db46985430612e0a4c2982472cecc0f542
SHA512

5662a4ba4ec8247eb3d7807e1a88e25ce2e4ed7b90d880b384aca53d1e537bf9557bd068dadba4c13084869f38df0e7285aeabf2d00b3003879fd48a026ec4b9
SSDEEP

48:C6Vo9HBok7lYa92RranDBetlG9MgByXM28o4+W7C9iUbheoC:nI2RrUeqvUMDo4+W7C9i0heoC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 2980	364	rundll32.exe	82
PID 364 wrote to memory of 2980	364	rundll32.exe	82
PID 364 wrote to memory of 2980	364	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b81def52ca42f03eac29aa175d01b7db46985430612e0a4c2982472cecc0f542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b81def52ca42f03eac29aa175d01b7db46985430612e0a4c2982472cecc0f542.dll,#1
  2⤵
  PID:2980