56d44fc433217043d9640a7a48ddc79caec9d3606de4d13098c708e8228918bd

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 23:17

Target

18ceb866a5441d68f99d4bbbc6bb2e83.dll
Size

312KB
MD5

18ceb866a5441d68f99d4bbbc6bb2e83
SHA1

425015a045301aa56d78357c76509cd07a399052
SHA256

56d44fc433217043d9640a7a48ddc79caec9d3606de4d13098c708e8228918bd
SHA512

bb8769cdead9f1246e1a453a770b8e056efbe68606ad16a1a6f43e489b57841689d66ae1a2f8d4a3f21a1564be82de7699f8f28c645fbf2ef62b0af8987843b7
SSDEEP

6144:nmf6+Wb2lIcWzdqKfhMtO4F0F/ih0A77ge3LojhqoqEfGaVVw6WzTZ:fQIc2dqKfhM446F20A7ke3LeVfGcVwBt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3100	2256	rundll32.exe	85
PID 2256 wrote to memory of 3100	2256	rundll32.exe	85
PID 2256 wrote to memory of 3100	2256	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18ceb866a5441d68f99d4bbbc6bb2e83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18ceb866a5441d68f99d4bbbc6bb2e83.dll,#1
  2⤵
  PID:3100

memory/3100-0-0x000000001FC20000-0x000000001FC73000-memory.dmp

Filesize
332KB

Download