b4facc08c669ba256e9750ea3e1639ebffbb2dbf74f2987fe508a34392480d14

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 22:30

Target

15d93682e466b60ea2df7b0bec372899.dll
Size

192KB
MD5

15d93682e466b60ea2df7b0bec372899
SHA1

94a1d096ecfff4036bbf3e99efc4fe64eaf8eecb
SHA256

b4facc08c669ba256e9750ea3e1639ebffbb2dbf74f2987fe508a34392480d14
SHA512

0517825cdbfbaad1b838ab5c60eaad9af22b03608d482a120a7b09cd08f152f750e447ce6eb94a4d9948d4d6b53cadfafb6abf0a40dee9d48bddf30ae92eb1ec
SSDEEP

3072:VNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/HrmM:VNbqaLD7RcukVAtSQOWcgWqbV77LmM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 396	3168	rundll32.exe	88
PID 3168 wrote to memory of 396	3168	rundll32.exe	88
PID 3168 wrote to memory of 396	3168	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d93682e466b60ea2df7b0bec372899.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15d93682e466b60ea2df7b0bec372899.dll,#1
  2⤵
  PID:396