5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a

Analysis

max time kernel
162s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 01:28

Target

5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a.dll
Size

5KB
MD5

c7149a707db8a358c7e1ea1bf5dc8cd0
SHA1

35e59e1d6706c1d88817a587bff76c2c3bc3af67
SHA256

5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a
SHA512

333b8b312bd3fbf771ae49a938766de52d76dcf7c8f610e7edd017520bf2123c0162e3bf941f8f6f7483306083aee91b160d6c6f61c12a960901d468c228d98a
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaialRFr:XUcA+ggd+W/If0ier

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1172	2100	rundll32.exe	82
PID 2100 wrote to memory of 1172	2100	rundll32.exe	82
PID 2100 wrote to memory of 1172	2100	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ffb331ef6cefeb401b2092e3259e68e36f5334ea321ee71e67ced3bd34dd03a.dll,#1
  2⤵
  PID:1172