577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:30

Target

577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791.dll
Size

5KB
MD5

31c563e8f65c3b642945abeb92b31d20
SHA1

d8adc5d8c9679840dacff9d85b9fb0e8b3f6c2ac
SHA256

577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791
SHA512

b98ae8ac89ab0ef31cdeab62f459d13142d4505237a49865dd25ec9abffb924aa94ba014097710062f34e78eb231bf4e2a3b73f00bcfb655a9c0e5a11a4afd26
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiHRSF:XUcA+ggd+W/If0idRk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1944	2008	rundll32.exe	80
PID 2008 wrote to memory of 1944	2008	rundll32.exe	80
PID 2008 wrote to memory of 1944	2008	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\577b52d6e76ae4669ceb3f73837f05f2f2aaa18fa52a958af2a47bb895ee5791.dll,#1
  2⤵
  PID:1944