6be928583190c89d1e909c804694ff349bfa858335f59f063f6c7d9c2132d14e

Analysis

max time kernel
134s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 19:38

Target

0e20fa82227f2e0ad6179dd0539dd152.dll
Size

151KB
MD5

0e20fa82227f2e0ad6179dd0539dd152
SHA1

efa6a787a767b221680fc030383b428b4f61b25f
SHA256

6be928583190c89d1e909c804694ff349bfa858335f59f063f6c7d9c2132d14e
SHA512

277bef3d0d91b240c032d8d1ded031cd31cdd72407661692905d31773d04d0aea0601ec7bce6f613b0d3a5a8b241991e3562bb5caf8f2daaf02f84cfca03b6bf
SSDEEP

3072:idjyH/4sZTgEBMnx21kRlZ3FyT1OVkoshX3RAURJ4JvRY5A17X8pXOfbw:0jyH/4sZTgiM81kRT3W92WkvKU8pXOD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2420	1220	rundll32.exe	88
PID 1220 wrote to memory of 2420	1220	rundll32.exe	88
PID 1220 wrote to memory of 2420	1220	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e20fa82227f2e0ad6179dd0539dd152.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e20fa82227f2e0ad6179dd0539dd152.dll,#1
  2⤵
  PID:2420