8f70a23ebfb91e4ba7b8c8a1480b3f4c4cd6353657d6895d2ef4e88b550e7cac

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:41

Target

01cbb3ec3205e375637230ca141e748f.dll
Size

28KB
MD5

01cbb3ec3205e375637230ca141e748f
SHA1

3ff7db63c7219eac898a22dd327862c5e452cac4
SHA256

8f70a23ebfb91e4ba7b8c8a1480b3f4c4cd6353657d6895d2ef4e88b550e7cac
SHA512

fae8b02a1229e06d52c54b78580c2a8936c55cf8dd6101f8387d9618551be2964bc89921d0187e3599ec18827909e96e0e3b039c62684998e0805a5ef2027002
SSDEEP

384:fWAG84BlBBMZ4SptNQssFAAFsrczlWYdbuex7wPM5Lg87WgH+pRl:zGlMXVsdFfbuexNFdHmRl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3340	3016	rundll32.exe	86
PID 3016 wrote to memory of 3340	3016	rundll32.exe	86
PID 3016 wrote to memory of 3340	3016	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cbb3ec3205e375637230ca141e748f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cbb3ec3205e375637230ca141e748f.dll,#1
  2⤵
  PID:3340