e49930f989d56d57785ee2df0ce9a4b2fd0c04a668b307b3422cc4c5b279787c

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 19:35

Target

0de7e3a01be48fbaf43502c43fbadee5.dll
Size

24KB
MD5

0de7e3a01be48fbaf43502c43fbadee5
SHA1

bb2320e42c0b45c8664b87fa5ab0af72e79d4a01
SHA256

e49930f989d56d57785ee2df0ce9a4b2fd0c04a668b307b3422cc4c5b279787c
SHA512

3d7e2d9a74caa8eab69114c85f5cebfb0384e7d974838892149bea0ac6dbce8c63542e4cb5fd3ea3f217291736925a5787c8075f2475e55a559d37fad2d4d75f
SSDEEP

768:gDT3ucpRiGSFvTBBHDUvUzMOKs/owgy5+j+35Ht:QLucZSF7BBHDU8zMOKWowgy5+jgt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1316	348	rundll32.exe	62
PID 348 wrote to memory of 1316	348	rundll32.exe	62
PID 348 wrote to memory of 1316	348	rundll32.exe	62

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0de7e3a01be48fbaf43502c43fbadee5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0de7e3a01be48fbaf43502c43fbadee5.dll,#1
  2⤵
  PID:1316