efcf2d5947b9acc3f826c82dc3589d49c5260fd22fa6ab4899188a31f7b55281

Analysis

max time kernel
137s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 04:37

Target

efcf2d5947b9acc3f826c82dc3589d49c5260fd22fa6ab4899188a31f7b55281.dll
Size

1.4MB
MD5

a1666f201aacec1e22c35fd4de43250a
SHA1

07807aee60c08a81cc9a27c94180ad28eabe3369
SHA256

efcf2d5947b9acc3f826c82dc3589d49c5260fd22fa6ab4899188a31f7b55281
SHA512

f711a0d2f4f42ef47c9a4e449f5b378c489bc6cd7dda9204f40edf61232b2f0f4ae46c03953545a9c59eec1780449436a57d594af534b53e5a0b4cefc49a5e21
SSDEEP

24576:SZGNpSjZ4h7POKX1UshOrD5CWQ70BN8uum94+BHL3Pv:5pSqh7mdsI3ozug+ZDPv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 4320	3456	rundll32.exe	84
PID 3456 wrote to memory of 4320	3456	rundll32.exe	84
PID 3456 wrote to memory of 4320	3456	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efcf2d5947b9acc3f826c82dc3589d49c5260fd22fa6ab4899188a31f7b55281.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\efcf2d5947b9acc3f826c82dc3589d49c5260fd22fa6ab4899188a31f7b55281.dll,#1
  2⤵
  PID:4320