2fca18c868321c0bc8287753fa422175bdbb953e5b1c9dd7aac9b19ec4fcd61e

Analysis

max time kernel
123s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 12:35

Target
2fca18c868321c0bc8287753fa422175bdbb953e5b1c9dd7aac9b19ec4fcd61e.dll
Size 825KB
Sample230819-psfbkshh84
SHA256 2fca18c868321c0bc8287753fa422175bdbb953e5b1c9dd7aac9b19ec4fcd61e
MD5 cc0a8b972bd3d12acf088c2191eb402e
SHA1 8462d47238e0d3bc159a889b9272774b65d0d88b
SHA512 9923bc3661fe2b6731ce5f043b18a359e16bb48380edfbeec551be8c731d83354d8109c32ab74a050d42c0fa3c8c2588c24a590b30ca85ea2a8893f64fafa31e
SSDEEP 6144:+lVaBjLEGE0mpQyelIpdl7xTzebwnlYLS3nwtyzz/VN5MCkh7A8uPuVDVu/Jo:e0EnQyzpr7xuGzMCmWCOo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3480	2716	rundll32.exe	82
PID 2716 wrote to memory of 3480	2716	rundll32.exe	82
PID 2716 wrote to memory of 3480	2716	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fca18c868321c0bc8287753fa422175bdbb953e5b1c9dd7aac9b19ec4fcd61e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fca18c868321c0bc8287753fa422175bdbb953e5b1c9dd7aac9b19ec4fcd61e.dll,#1
  2⤵
  PID:3480