9a9a08ad1d2c38803ffdbd5dfd50ba47619c4d84d374bfd9f42091acf610853d

Analysis

max time kernel
182s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:38

Target

041d3d2900b2dd11a40d34eb28eb9981.dll
Size

44KB
MD5

041d3d2900b2dd11a40d34eb28eb9981
SHA1

3c720988233ab34102acb8ff4a677a4f1d5f2eb0
SHA256

9a9a08ad1d2c38803ffdbd5dfd50ba47619c4d84d374bfd9f42091acf610853d
SHA512

65d5c63503c2e58a43c9a920ac4b6e28dee9e252440365d683ea632dfa3479d1694682c27b702dbeae80d54625e5218fc0b68a6e9e2200905bed1a226b0dfb18
SSDEEP

768:eKKede/qB46qVm6mrl1iHzJA3v45xWbxtQiMWAOe6IAOIjsxIsclsd:eaepjm6uXKv5xSQiMGeVIWIKd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2736	652	rundll32.exe	89
PID 652 wrote to memory of 2736	652	rundll32.exe	89
PID 652 wrote to memory of 2736	652	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\041d3d2900b2dd11a40d34eb28eb9981.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\041d3d2900b2dd11a40d34eb28eb9981.dll,#1
  2⤵
  PID:2736