571429b13e706edeb4bcfe72047df7e092190edde5a3954336fee1a289dbeab5

Analysis

max time kernel
128s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 22:06

Target

148e1e45c58dd4d9f108b072e238bb4d.dll
Size

53KB
MD5

148e1e45c58dd4d9f108b072e238bb4d
SHA1

1cddb2def41882092cddd00990c434b887a603fe
SHA256

571429b13e706edeb4bcfe72047df7e092190edde5a3954336fee1a289dbeab5
SHA512

da27b74b248f3ff23d125cb25af0242d8bbd1c23bb0fefc07a5d2b07801149d9cc25225417ec2390201256be876207f1732ca664e2265974cd29f38ccc27e1f4
SSDEEP

768:VguIXTgLKxpXYTz3yLStDUFJpDJoWfZYdAVDHZKntpkw2:Vg1XzpVFJroIAiDH0/52

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4196	2960	rundll32.exe	49
PID 2960 wrote to memory of 4196	2960	rundll32.exe	49
PID 2960 wrote to memory of 4196	2960	rundll32.exe	49

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\148e1e45c58dd4d9f108b072e238bb4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\148e1e45c58dd4d9f108b072e238bb4d.dll,#1
  2⤵
  PID:4196

memory/4196-0-0x00000000009E0000-0x00000000009E9000-memory.dmp

Filesize
36KB

Download