5818e80e183b36702709387e5c8893ebe372cc256014db326b693bc952fa966f

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:29

Target

5818e80e183b36702709387e5c8893ebe372cc256014db326b693bc952fa966f.dll
Size

24KB
MD5

b41e580264de44c9e3780b68eb74a310
SHA1

0e2d20e4d8701fccf8c9a9472a0269d2ca4c55c4
SHA256

5818e80e183b36702709387e5c8893ebe372cc256014db326b693bc952fa966f
SHA512

55732aae4f316c4bdcc1190d7ba1548ee0304390c9c87fb092c37f23b6202e22ff90a3e1a73a7c5c7a9413abc4971bca21b28a397be1a003d25b8b23992274b3
SSDEEP

384:cByRdBClPVQXDoaJ8BtSWRX84QjvL1RSXRIcvamzuuX9t:jcdVXe8mWRM4Qjj1oXRLR9t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1436 wrote to memory of 5092	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 5092	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 5092	1436	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5818e80e183b36702709387e5c8893ebe372cc256014db326b693bc952fa966f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5818e80e183b36702709387e5c8893ebe372cc256014db326b693bc952fa966f.dll,#1
2⤵
PID:5092