a3ec680e123b5dbaed861dc43bf5a5da94d48730ccc3144519b310e2affb6484

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2023 09:19

Target

1948-3-0x0000000000460000-0x0000000000482000-memory.dll
Size

136KB
MD5

e32bc76075158fd38e172bb2a6d38021
SHA1

85a150506fd7ea63cd1e98fc6ab5d8510702408f
SHA256

a3ec680e123b5dbaed861dc43bf5a5da94d48730ccc3144519b310e2affb6484
SHA512

83c8cedae2952df48c6e97d18fe72fa29f8e3c1e0a17361f87236c0dc9c10a3fc6fd1f8acd30c4d6f0178feeba123c1c5442a02e96147354731803c07ca951f9
SSDEEP

3072:2rw7duvCaNgn3sg8CArJBnHuNTBf95AO:57duvtan3SHrJJHuNTBV5AO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2380 wrote to memory of 2760	2380	rundll32.exe	86
PID 2380 wrote to memory of 2760	2380	rundll32.exe	86
PID 2380 wrote to memory of 2760	2380	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-3-0x0000000000460000-0x0000000000482000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-3-0x0000000000460000-0x0000000000482000-memory.dll,#1
  2⤵
  PID:2760