bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65

Analysis

max time kernel
224s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:31

Target

bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65.dll
Size

63KB
MD5

5ea9bb51266236215d9fc357bb3c3a2d
SHA1

0500f880969b74ca30e103a8e2a5c3603d99b585
SHA256

bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65
SHA512

e75ad756a9c1ddf110bed480fcae6fd4e6010dfc03709f01578d5967cb8ed5f6a73ae89d705ef9f9161c7add3acdd40c1fedc946f109f7d11e3fd165e2a732d6
SSDEEP

1536:1zExMwCGQ2j9WXiqIWej6+jCF94q6DijvO8G:1I+wCGvwSqIWyjCV6QdG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 556	900	rundll32.exe	82
PID 900 wrote to memory of 556	900	rundll32.exe	82
PID 900 wrote to memory of 556	900	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bca1e0b4d43921390bdfdd1bb08b9a62152ccfd6d852d77b81e613fd17753d65.dll,#1
  2⤵
  PID:556