53f0de6c282dbf74fbf94fa6f7b605fc3a1822cd1c4a8363634b235d01a7ab24

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:30

Target

53f0de6c282dbf74fbf94fa6f7b605fc3a1822cd1c4a8363634b235d01a7ab24.dll
Size

6KB
MD5

c21447ba04239896e75a3880ddc51110
SHA1

6febcccbae23edbb5643b5911d267eeb4d217abd
SHA256

53f0de6c282dbf74fbf94fa6f7b605fc3a1822cd1c4a8363634b235d01a7ab24
SHA512

f7786d1f85379cf02539c8eb0db21554c2f2d7fbf4840d022ee846bb8676ca2396060d729e20b9d86477bddcce06c0e102023db44a4cf2469442211f6e706210
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4zwPcBh7vTTRKi:2M/SdjbgY0FBdTTR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 5080	5016	rundll32.exe	83
PID 5016 wrote to memory of 5080	5016	rundll32.exe	83
PID 5016 wrote to memory of 5080	5016	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53f0de6c282dbf74fbf94fa6f7b605fc3a1822cd1c4a8363634b235d01a7ab24.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53f0de6c282dbf74fbf94fa6f7b605fc3a1822cd1c4a8363634b235d01a7ab24.dll,#1
  2⤵
  PID:5080