378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22

Analysis

max time kernel
118s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 23:41

Target

378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22.dll
Size

96KB
MD5

85340e1406b3ec6e4f46c66e046d6fd0
SHA1

f472f3e892774dc7de180fc503f96c7ae05d7d39
SHA256

378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22
SHA512

33dc44399c2cf0a19a789327d8292091a15cc750eaa5a4c36f6fa3f86e1983e668620ef63a78a4f59cf91dfba1f5059ac773b00b4cab6892bf3e7a03a6b1f8c9
SSDEEP

1536:otR5VyhFNqGHvPkNddinDZjf7a5ziq92ndHNBl/M7PL6B:k9ezHvPk8+5GnJNn/M7PL

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4320	rundll32.exe
4320	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4320	3960	rundll32.exe	84
PID 3960 wrote to memory of 4320	3960	rundll32.exe	84
PID 3960 wrote to memory of 4320	3960	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\378542faa3264ee17923c2b1affe5315c4fd0b6831a9a7a5a7b26811ad3e1e22.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320