52cce15bf379401b0530221d8e2ea328edc3a77794573c22a7c2b30300ed3556

Analysis

max time kernel
77s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2023, 19:49

Target

52cce15bf379401b0530221d8e2ea328edc3a77794573c22a7c2b30300ed3556.dll
Size

188KB
MD5

1e10c810ce65a18a1f2bf488a8159bfe
SHA1

7a485fa79365f3ef18c10c640e2e77ce1e612070
SHA256

52cce15bf379401b0530221d8e2ea328edc3a77794573c22a7c2b30300ed3556
SHA512

1b23b57a4758a94e7c9c3bb5e2d81249560d6bfa7b64a017c8f47e26f1452390ea41e77f82d129f78f4188467869d4d5ee250209fa6b85ef79c3c17cf1c92e21
SSDEEP

3072:fh7t8H/ZZvyh9aZBchDNpINVb2BLaFxbOeId8lVnL+aoxC0ngeksaJRQE:fh7tkYWrcZNpINFqLIBKh7RaJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1264	1780	rundll32.exe	84
PID 1780 wrote to memory of 1264	1780	rundll32.exe	84
PID 1780 wrote to memory of 1264	1780	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\52cce15bf379401b0530221d8e2ea328edc3a77794573c22a7c2b30300ed3556.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\52cce15bf379401b0530221d8e2ea328edc3a77794573c22a7c2b30300ed3556.dll,#1
  2⤵
  PID:1264

memory/1264-133-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download