c10304961048c76003b08ad6b3f131305fbe2edd7b4ad6078c25d639b6500099

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 10:41

Target

0ab87ba67d8c2ea5e7fedcf8c82a1234.dll
Size

233KB
MD5

0ab87ba67d8c2ea5e7fedcf8c82a1234
SHA1

931ef11a190ed0a439ae89596df53d275df6b1ef
SHA256

c10304961048c76003b08ad6b3f131305fbe2edd7b4ad6078c25d639b6500099
SHA512

5d70c8363c51e33b2620ff27aef2a65c86ef65d097421437c4376c6fc04e76e0564e5f05d455724b9b10dca0b81e2bb97e9e9cba8cc72df2bef559c4b65e3d71
SSDEEP

6144:3O47KP5v/tEwxnzllMzNZ+pSqDuq4+vZzb8T42/YKi8DSau3:3ch/tEcBqqp36q4+vZbc51S/3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 3588	1304	rundll32.exe	87
PID 1304 wrote to memory of 3588	1304	rundll32.exe	87
PID 1304 wrote to memory of 3588	1304	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ab87ba67d8c2ea5e7fedcf8c82a1234.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ab87ba67d8c2ea5e7fedcf8c82a1234.dll,#1
  2⤵
  PID:3588