dcf93c6144fed5271fcce835bacc245aae1f00095bed6571620beef66f26d750

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 22:27

Target

15b230bb07aafefec90917215441c124.dll
Size

13KB
MD5

15b230bb07aafefec90917215441c124
SHA1

d7ebb0b834971c73f66131c80cfbfa959b609f61
SHA256

dcf93c6144fed5271fcce835bacc245aae1f00095bed6571620beef66f26d750
SHA512

13253a5cf42d78f9582a57da022947077c8329e666819063df5f8852c3194f46db22f7e8ac74ea5514440f203a54172673e426d5ef89163dad4d740a3a64d2d1
SSDEEP

192:4qZmrSrRYIRlm8SmhkMjyl2GlwgtNhXUcMEkSFacn2YE/eGNfWn0c:9mrORYMXkM82Gllji2nHSxe0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3820	4408	rundll32.exe	88
PID 4408 wrote to memory of 3820	4408	rundll32.exe	88
PID 4408 wrote to memory of 3820	4408	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15b230bb07aafefec90917215441c124.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15b230bb07aafefec90917215441c124.dll,#1
  2⤵
  PID:3820

memory/3820-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/3820-1-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/3820-2-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download