5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693

Analysis

max time kernel
89s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2022, 14:15

Target

5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693.dll
Size

141KB
MD5

ee94f46ed9b387ad243c36c1cb062686
SHA1

6e0c4dc795dec2dce9454fbb246afabffd2039fc
SHA256

5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693
SHA512

63eaa037e82775efbe7af57af82613b6b01acc56a12085467f6eb32b7e71dfcbe6791300618f6f0f3203f0d2dd5a924ae3b742a478d5fd7e6917e92d1a47d7e2
SSDEEP

3072:1P5WCVyQQdnzs14CSJBXrHdKENrcIHEI9wG:1P5WgQNLCGT5ccEC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3740	4628	rundll32.exe	82
PID 4628 wrote to memory of 3740	4628	rundll32.exe	82
PID 4628 wrote to memory of 3740	4628	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c90e87df09275cfcb46e0452d77e149f3fbc59d55bda76e62e6fa11ae1de693.dll,#1
  2⤵
  PID:3740