41c7d590f7d9c7113f0f1120b6ad7fb6d43d4a26f41f284d2be72f54ee579390

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2023 16:16

Target

41c7d590f7d9c7113f0f1120b6ad7fb6d43d4a26f41f284d2be72f54ee579390.dll
Size

81KB
MD5

398d7d9e191daa122d467645e09f8fbd
SHA1

c1a45919cbdfb2b5ed90b2930834fcdaa9460f2b
SHA256

41c7d590f7d9c7113f0f1120b6ad7fb6d43d4a26f41f284d2be72f54ee579390
SHA512

94c4e85797ccafc7531ff021e745e7f002c4feb5823766550401933a6cd891b44c3099a7bf44c80b2dfdd030871e7b84166844fa1246f5f6f4f4280826fb0348
SSDEEP

384:IJlA49GD+uADV4MysgwjTjq9vJCNwM+hADXDSQ7xihHsfRfYdVwL+nQax5Eyiw3K:IJmFfMykqVJCNwM+GjPqA6eIcce8mx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3972	4960	rundll32.exe	88
PID 4960 wrote to memory of 3972	4960	rundll32.exe	88
PID 4960 wrote to memory of 3972	4960	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41c7d590f7d9c7113f0f1120b6ad7fb6d43d4a26f41f284d2be72f54ee579390.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41c7d590f7d9c7113f0f1120b6ad7fb6d43d4a26f41f284d2be72f54ee579390.dll,#1
  2⤵
  PID:3972