93b7c9024bc31557749f078991be4024cf13fab4452c86c69a1cc78b6e53c567

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2023 16:03

Target

93b7c9024bc31557749f078991be4024cf13fab4452c86c69a1cc78b6e53c567.dll
Size

2.0MB
MD5

37ee0e572ca91c96da360088af9a8bbd
SHA1

4b0fee643090e143ad6ba09b41b21ded3a9b9377
SHA256

93b7c9024bc31557749f078991be4024cf13fab4452c86c69a1cc78b6e53c567
SHA512

5036b613fedfc12ce8a78484c421d63fa9306299759710ae0692051dc38891106fa112a0f420468966100035a0fdd2b9b6135325349da2d5b761697456776088
SSDEEP

49152:ydgj80ZoABqifJHpN3CswNql1WyN+T14so9NtpG:ydgjTPpN3Kql1Vo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4716	4644	rundll32.exe	88
PID 4644 wrote to memory of 4716	4644	rundll32.exe	88
PID 4644 wrote to memory of 4716	4644	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\93b7c9024bc31557749f078991be4024cf13fab4452c86c69a1cc78b6e53c567.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\93b7c9024bc31557749f078991be4024cf13fab4452c86c69a1cc78b6e53c567.dll,#1
  2⤵
  PID:4716