f57ef018d93f52801d32be70c5599fb202d3156ffdc494547832daab129035da

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 16:13

Target

051f85f46c6595bbcf8d757133915b47.dll
Size

335KB
MD5

051f85f46c6595bbcf8d757133915b47
SHA1

e286ffb9ea5f3c184c7955b2e3f4e38370d082a3
SHA256

f57ef018d93f52801d32be70c5599fb202d3156ffdc494547832daab129035da
SHA512

651b1d5134f8a4488415104cf0aee0a1c746e1cdae2e99a89c0fc208e9ae00a82354ecc9da356108d2dfdf5811f97f39fe2dc292abbecbcab0f2d23a26dba110
SSDEEP

6144:jC1XD9LSc2PLs443pa6hufuFmzED2QpPyO0rCHqOidXw7E20+kqZRp+:jC1XhSc2PKMKufImzED2g6O0rCHqC7z6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4384	3172	rundll32.exe	84
PID 3172 wrote to memory of 4384	3172	rundll32.exe	84
PID 3172 wrote to memory of 4384	3172	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\051f85f46c6595bbcf8d757133915b47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\051f85f46c6595bbcf8d757133915b47.dll,#1
  2⤵
  PID:4384