05554521f65ad2ca2e37551245d2705124dc544474bc95730bc31f3d9e3c9aed

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 11:57

Target

05554521f65ad2ca2e37551245d2705124dc544474bc95730bc31f3d9e3c9aed.dll
Size

1.5MB
MD5

a217c0458b5886a34d63193c0e11169d
SHA1

89abfb9f4fdb450daf72e347b9339d43340ea1dd
SHA256

05554521f65ad2ca2e37551245d2705124dc544474bc95730bc31f3d9e3c9aed
SHA512

2d70220cfadf79903c2240809d87f028e5e7e1136e49d29a2f183a32ee0963d8b0902b3ce2c3243840d10d659b51056c19d71ce92205808d01ef1d9c2f1bdbf9
SSDEEP

49152:V6yOUtEvoZgVdgEKYVxGITWIdogVRUL9JfkRdSvqH3Rk82L490LW:VGUdgVmEKYVxGITfd33UL9JzvqHBk82s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3880	4684	rundll32.exe	83
PID 4684 wrote to memory of 3880	4684	rundll32.exe	83
PID 4684 wrote to memory of 3880	4684	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05554521f65ad2ca2e37551245d2705124dc544474bc95730bc31f3d9e3c9aed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05554521f65ad2ca2e37551245d2705124dc544474bc95730bc31f3d9e3c9aed.dll,#1
  2⤵
  PID:3880