e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa

Resubmissions

21/09/2023, 04:37

21/09/2023, 04:27

max time kernel
442s
max time network
448s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 04:37

Target

e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa.dll
Size

1.4MB
MD5

64e04aa44766d3a1edf8362bbaba0a1c
SHA1

2605422b1bb3ddfa67e5c82229627aa06d2cd926
SHA256

e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa
SHA512

14a6dfee7bbb9dc566db3c5b35f022054947a6ff23a43451a71efaa43cc5411d68492455d4a359d1c22f44a23366584399f7fa843d82958b8477ae1c17638829
SSDEEP

24576:fJmyeKfuSBsRsq0iuSNDMRPnMyJ8q6NXBoJu5ubUrl3z9n+IUYgkVRDufwzHn9u:fVpj6RhhLMRvMyJW/u6thUkfFB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 5100	4620	rundll32.exe	84
PID 4620 wrote to memory of 5100	4620	rundll32.exe	84
PID 4620 wrote to memory of 5100	4620	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8f01484c55aedfcccebb8c0599a165e78ced2f3e63223f6fbdcd92d78305ffa.dll,#1
  2⤵
  PID:5100

memory/5100-0-0x00000000011B0000-0x00000000011B6000-memory.dmp

Filesize
24KB

Download
memory/5100-1-0x0000000010000000-0x0000000010167000-memory.dmp

Filesize
1.4MB

Download
memory/5100-3-0x0000000002D30000-0x0000000002E3D000-memory.dmp

Filesize
1.1MB

Download
memory/5100-4-0x0000000002E40000-0x0000000002F33000-memory.dmp

Filesize
972KB

Download
memory/5100-7-0x0000000002E40000-0x0000000002F33000-memory.dmp

Filesize
972KB

Download
memory/5100-8-0x0000000002E40000-0x0000000002F33000-memory.dmp

Filesize
972KB

Download