b2ee5d505541463dec95cf4fa8cb764c031cc08d456a22aa905eedfebbfa6e41

Analysis

max time kernel
170s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 03:08

Target

b2ee5d505541463dec95cf4fa8cb764c031cc08d456a22aa905eedfebbfa6e41.dll
Size

2.0MB
MD5

e226e1cc64b83f96fc8b82c48dd4bc3f
SHA1

2a0d157fd8d1c761b40f0bb5cb7b0542c16f2879
SHA256

b2ee5d505541463dec95cf4fa8cb764c031cc08d456a22aa905eedfebbfa6e41
SHA512

5b98b09a95ac6a3dcceeeb04c3625edea0bf76b3e5f6977df15c470604c00fd56148d7fdbd28a790f50ac6f02e8618f1e2ea8d0e0fa854c32e54d45e0c4461aa
SSDEEP

49152:4FIbdyf/viyuEC3GgcqlVi9/6pNMEhJL1Hvra:QIbg/amgcqlVi9/6pva

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3408	2848	rundll32.exe	86
PID 2848 wrote to memory of 3408	2848	rundll32.exe	86
PID 2848 wrote to memory of 3408	2848	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2ee5d505541463dec95cf4fa8cb764c031cc08d456a22aa905eedfebbfa6e41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2ee5d505541463dec95cf4fa8cb764c031cc08d456a22aa905eedfebbfa6e41.dll,#1
  2⤵
  PID:3408