70765af4e62f53adabe0872f38df0c84f4809321e80f341874f9f6c093fa23b8

Analysis

max time kernel
157s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 22:57

Target
177f531d10e02f34c00d3105759b3031.dll
Size 146KB
Sample231224-2xf5wsadd2
SHA256 70765af4e62f53adabe0872f38df0c84f4809321e80f341874f9f6c093fa23b8
MD5 177f531d10e02f34c00d3105759b3031
SHA1 e5412118574df74fdf444c86df1ce2d0cc51d950
SHA512 b1c4395abb95746321d538a3d3b8a113411ba6a6790dfa5f1ece952165104bc1ae3b03d58eb8184e1ad94992b4e44dc1e44fce7fd03ec3c1976c539c69d3db33
SSDEEP 3072:s/inUh2LG3l1ygQ/fjoWuoBP6N1sZ9PlybGbdLrMvKYQJakH7:s/iUh2a11ygK+OQ499bdMvRC7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3360	3308	rundll32.exe	88
PID 3308 wrote to memory of 3360	3308	rundll32.exe	88
PID 3308 wrote to memory of 3360	3308	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\177f531d10e02f34c00d3105759b3031.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\177f531d10e02f34c00d3105759b3031.dll,#1
  2⤵
  PID:3360

memory/3360-0-0x0000000000890000-0x000000000089A000-memory.dmp

Download

memory/3360-2-0x0000000010000000-0x0000000010031000-memory.dmp

Download