9dbeb9eb69f446352fdefdf4d72b1f28cc40683e030d6478ebe2bb4cb8ee52df

Analysis

max time kernel
90s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2023, 20:43

Target

4cwl5BVJE.dll
Size

345KB
MD5

8b580d60bc10bcdaaa59d54b679c88f9
SHA1

57fd712b5a187c18fd20753f2f3774aa84694cdf
SHA256

9dbeb9eb69f446352fdefdf4d72b1f28cc40683e030d6478ebe2bb4cb8ee52df
SHA512

18e50530c081d291c5add66030e40c9bf1cb49af9a0fffb8bd81a3aaecbafce838e1c4889d0603b43b4408d4c98b1e50cc0ff6a9e7b5af69931f6a264fc6e220
SSDEEP

6144:rGpptTq76Et/NPHn1PdjxFJwMoW9vTWF5K6bVt2Eyfs/nqlbbHyx2f8qo+AwrOs:rG7Nq76qPVltfTvTWF5K6zPyfsyZ+x2p

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 560	3328	rundll32.exe	77
PID 3328 wrote to memory of 560	3328	rundll32.exe	77
PID 3328 wrote to memory of 560	3328	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cwl5BVJE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cwl5BVJE.dll,#1
  2⤵
  PID:560