4770f7d40522e6c79cea09ae4af16b5e9f79f7ccfbc7131abd7dd9b76f14bbb4

Analysis

max time kernel
154s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:47

Target

0219a87f3c96d8d71f7b7e8acf3c8b7a.dll
Size

119KB
MD5

0219a87f3c96d8d71f7b7e8acf3c8b7a
SHA1

975bea51ef86c1f17f3063a50172265d7773a08d
SHA256

4770f7d40522e6c79cea09ae4af16b5e9f79f7ccfbc7131abd7dd9b76f14bbb4
SHA512

dba907c1081c9d7d2f8b967b8784979e0bffc59bad0cecc106f5155bc4218dfa9c9fcf382e327d70ce7d9ef30f7964aa90eb8a5595d8ef51fd16bf76861a3018
SSDEEP

3072:GbVQT6rk6QrWnPzlSVkec8Hk50yE5MoeIDQPIX5AJ7Cl:Gbqmrk6ZPpSV7cIyCfQPIXS7A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 5012	3352	rundll32.exe	87
PID 3352 wrote to memory of 5012	3352	rundll32.exe	87
PID 3352 wrote to memory of 5012	3352	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0219a87f3c96d8d71f7b7e8acf3c8b7a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0219a87f3c96d8d71f7b7e8acf3c8b7a.dll,#1
  2⤵
  PID:5012

memory/5012-0-0x0000000000600000-0x0000000000623000-memory.dmp

Filesize
140KB

Download