0e8eeb9db5abec467290019df00c0db97682ca7f34a936e8bc6503bda6d04e4b

Resubmissions

17-07-2023 16:37

17-07-2023 15:43

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2023 15:43

Target

Lab12-01.dll
Size

48KB
MD5

a6fb0d8fdea1c15afba7a5ddb3d2867b
SHA1

d38b6cadbdbc8ef6d29ffcdde80d5bcc9519c8e1
SHA256

0ea89a83b84b8d20e259bacb6b0d1b176c8327f097c54749ae832981f2a0095a
SHA512

79468f218b8a9265dd12abea72bb70caa2b704a00fed3ff22407ce0853f1077c25146e0a8b6421f1cfaf04df658c7f3e19ffc309e8b541bb0c66c455996cb79b
SSDEEP

384:gqF9W9h/gU/f3bTZUbJwk08fY4aPCuagjDx27wWjNd4Sdcxy5JubR0hu8+cAG8o4:RYYKf3bTCbV0UY4aTjd2PHgPd0huG8o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4000	3564	rundll32.exe	83
PID 3564 wrote to memory of 4000	3564	rundll32.exe	83
PID 3564 wrote to memory of 4000	3564	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lab12-01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lab12-01.dll,#1
  2⤵
  PID:4000