5f4c53a85585999778fcb16f2be1a32be8ac1452e4aafd5c9861c9b5e400d5c9

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:14

Target
5f4c53a85585999778fcb16f2be1a32be8ac1452e4aafd5c9861c9b5e400d5c9.dll
Size 60KB
Sample221206-blvwssdh73
SHA256 5f4c53a85585999778fcb16f2be1a32be8ac1452e4aafd5c9861c9b5e400d5c9
MD5 7268940fad0e01c291871a732cbdcb1b
SHA1 7cfbe0e8eed853ea58f3977123e8566b26c6b86f
SHA512 4601b035364f862860475eefaa048ca214c16f1fa5d29a41cc1f5e39770fd491c0d48ea229158309b22bd5549accc15101439aba14810953913ac1bb76da02e6
SSDEEP 1536:n7ZLNPp9pZBMVvu5zSi4Rk5/X9wd6J3jB62+IW1:7Zpp6W5GRSIKzI2+Ik
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4556	4836	rundll32.exe	81
PID 4836 wrote to memory of 4556	4836	rundll32.exe	81
PID 4836 wrote to memory of 4556	4836	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f4c53a85585999778fcb16f2be1a32be8ac1452e4aafd5c9861c9b5e400d5c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f4c53a85585999778fcb16f2be1a32be8ac1452e4aafd5c9861c9b5e400d5c9.dll,#1
  2⤵
  PID:4556