060547e9b166de7c04a9187a125d9d59ad0339300deb12cd65ba24bb94d99dbb

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:02

Target

0f7fc33df772469e9e1067aba3e19f6b.dll
Size

192KB
MD5

0f7fc33df772469e9e1067aba3e19f6b
SHA1

fbc5a5345f5cdb167fd0fd2eceebcb5f3b992f43
SHA256

060547e9b166de7c04a9187a125d9d59ad0339300deb12cd65ba24bb94d99dbb
SHA512

51fa3a2ac35a62e795dfc8a9ea1f97dee2172df10aace989bc217d54806524563992ded204192214a9a959bd59864255bf03ccc6b1951dcaba7d8ae267376981
SSDEEP

3072:WNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/HrmH:WNbqaLD7RcukVAtSQOWcgWqbV77LmH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3096	5052	rundll32.exe	88
PID 5052 wrote to memory of 3096	5052	rundll32.exe	88
PID 5052 wrote to memory of 3096	5052	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f7fc33df772469e9e1067aba3e19f6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f7fc33df772469e9e1067aba3e19f6b.dll,#1
  2⤵
  PID:3096