5ee0ee1b74d1139a6d258bc86f42dcc460dea2e51b2892ffe762825e842b07ff

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:17

Target

5ee0ee1b74d1139a6d258bc86f42dcc460dea2e51b2892ffe762825e842b07ff.dll
Size

327KB
MD5

114a8a25e4081eab6e2af6cd71682337
SHA1

aeb903e38040549587affa5c6f01a4afb78a6096
SHA256

5ee0ee1b74d1139a6d258bc86f42dcc460dea2e51b2892ffe762825e842b07ff
SHA512

6a1288da50d8460af538010b3bbd773fd352b8e716d947d2a49e889f1f518db735f30ce94e53e4cd560e0d4ca4b131a8f80c65e277a885f9950f2918f42e4c11
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3240 wrote to memory of 3060	3240	rundll32.exe	rundll32.exe
PID 3240 wrote to memory of 3060	3240	rundll32.exe	rundll32.exe
PID 3240 wrote to memory of 3060	3240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ee0ee1b74d1139a6d258bc86f42dcc460dea2e51b2892ffe762825e842b07ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ee0ee1b74d1139a6d258bc86f42dcc460dea2e51b2892ffe762825e842b07ff.dll,#1
  2⤵
  PID:3060