861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 10:44

Target

861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll
Size

213KB
MD5

fba481774812fa3c6424bece81f4923d
SHA1

cd93cc0fc436dd9cffda641f62edfd9409c3066d
SHA256

861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e
SHA512

e7c5a659d3e15e53a3247c90175d4c7a8dacffd34a551c090b9c8478f2b9883cde9790e181b7f4cc74a8ce767537111c4cf279a8e0a9ffb9332a44c2aeece9b4
SSDEEP

1536:N8ZkXEMm6jh/3XNPpdpytxr5QSM9JaIbRZmFcPgHrme:PEA3XNItTQSM9JaIbRZmFcPle

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3880	3344	rundll32.exe	83
PID 3344 wrote to memory of 3880	3344	rundll32.exe	83
PID 3344 wrote to memory of 3880	3344	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\861794ebfbb2be263ece9aca4e318c45e19df9306d30d2ebeba32f0453e9140e.dll,#1
  2⤵
  PID:3880

memory/3880-0-0x0000000000780000-0x00000000007BA000-memory.dmp

Filesize
232KB

Download