22e50202fff8a50ebb5561dbe0b13c3e2f5269a5539a0beb277feef3de07b58d

Analysis

max time kernel
92s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 14:51

Target

024541ec54d97a60811b0543d3c7b144.dll
Size

1.5MB
MD5

024541ec54d97a60811b0543d3c7b144
SHA1

9f0fa26f8795ec03dd535cf9d36c42ea97440c9f
SHA256

22e50202fff8a50ebb5561dbe0b13c3e2f5269a5539a0beb277feef3de07b58d
SHA512

5f17044611c5aff385a78e9f85ca49b168f906b7b36a59c73db7f7681e0a5fea6c4b0da5552f02297da3d44d167b501a7fe5b64870cde161a607dc284274394a
SSDEEP

24576:3n1aQ9goUu+pS0+M3tb0pvaep5Z3gmllsQUfIKKuZAP23J24gWzmIQMFfuzKY3n:3goUu/0J3tCieD1p/sQxKbJtLQMFfuPn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 5032	3536	rundll32.exe	15
PID 3536 wrote to memory of 5032	3536	rundll32.exe	15
PID 3536 wrote to memory of 5032	3536	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\024541ec54d97a60811b0543d3c7b144.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\024541ec54d97a60811b0543d3c7b144.dll,#1
  2⤵
  PID:5032