059c973591257b1dacea7ae4ee03e4056b663bd1ce576374f550cbca33b97f4a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:37

Target
017eda9608450c67c41bf014a02de78b.dll
Size 49KB
Sample231224-rzbm3sgber
SHA256 059c973591257b1dacea7ae4ee03e4056b663bd1ce576374f550cbca33b97f4a
MD5 017eda9608450c67c41bf014a02de78b
SHA1 ab69ea278d8dee739f2e8036ac1ca856c8327989
SHA512 d94b6a90a464ee96b1d1657d580afc75f03f1314aba7da64877da22ca04d71689d7113c1798730aad6ce5ad6f68f6bc12add3879b5e6d966a988fe40a78f1d64
SSDEEP 768:QQzToao3ZqukH0u5A9sntXlQnH/iyCbIED8hn1cGQL+:JVukH0uYUtXCZEQx1cHL+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2136	1516	rundll32.exe	14
PID 1516 wrote to memory of 2136	1516	rundll32.exe	14
PID 1516 wrote to memory of 2136	1516	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\017eda9608450c67c41bf014a02de78b.dll,#1
1⤵
PID:2136

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\017eda9608450c67c41bf014a02de78b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516