464348bfb89ecea601b69028d1c681b3dd152f3da57afaa19ded141a5ad37c54

Analysis

max time kernel
144s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:43

Target

01e4a05351b733a378b1e7a5944d18f4.dll
Size

161KB
MD5

01e4a05351b733a378b1e7a5944d18f4
SHA1

f72b056652da43b726ba3d1d95d9a32a1fb429c1
SHA256

464348bfb89ecea601b69028d1c681b3dd152f3da57afaa19ded141a5ad37c54
SHA512

30b84b576cb4319dd920ea929920f5d7c704aca0862f3e06865c36005fec5de98beb0d3fd67beb8277b18dde6cb038c1b0e1e3657cd8236bb83e7071620c0b6d
SSDEEP

3072:SEQBxpL965O23oAfDNKDRavPodi3fw5dBS5Kym7jhljwh8w5+z2aog0:SvBDcvJUaINSKd3hFwhn5y2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1700	856	rundll32.exe	88
PID 856 wrote to memory of 1700	856	rundll32.exe	88
PID 856 wrote to memory of 1700	856	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01e4a05351b733a378b1e7a5944d18f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01e4a05351b733a378b1e7a5944d18f4.dll,#1
  2⤵
  PID:1700

memory/1700-0-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download
memory/1700-1-0x00000000012C0000-0x00000000012CA000-memory.dmp

Filesize
40KB

Download