54cfa9069f10c88406492722febdf2e2265090945cef5b186a5eb2320b641787

Analysis

max time kernel
99s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:04

Target

17faf529f224eaaf36c8f9235ff13529.dll
Size

117KB
MD5

17faf529f224eaaf36c8f9235ff13529
SHA1

7dd733f19e869dd07c16b0b9c7a98e9907f6560b
SHA256

54cfa9069f10c88406492722febdf2e2265090945cef5b186a5eb2320b641787
SHA512

2b9a7816e6b5d5f6612479ee4ea1ce7892df00a05e587c091810a5886a87afa6ad041d12825f01842f0ff641552a967abb1bc6fca1bb8baffa6b25c9b9d9d5de
SSDEEP

3072:vahXhaw/JDs9yajKALITVlJpTlX0TvsPj8Egfhm04Isng0Koq:v6oGdFZRT1qE78EgfhT0Koq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3320	1540	rundll32.exe	14
PID 1540 wrote to memory of 3320	1540	rundll32.exe	14
PID 1540 wrote to memory of 3320	1540	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17faf529f224eaaf36c8f9235ff13529.dll,#1
1⤵
PID:3320

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17faf529f224eaaf36c8f9235ff13529.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540