71f942951c7fdd8d7bb207b848924661a59c252780b7ec9d77c9a1f8e0d4e8f2

Analysis

max time kernel
93s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 23:29

Target

4349ac48408f0238514ea7ba1c5736f2.dll
Size

13KB
MD5

4349ac48408f0238514ea7ba1c5736f2
SHA1

c9e9c600850b6c57f468dd027988fb6ae34e1e86
SHA256

71f942951c7fdd8d7bb207b848924661a59c252780b7ec9d77c9a1f8e0d4e8f2
SHA512

aba102f725b1c8caade7dd56317557f2df5c7d16041ce5e159f20f66dab51925ee6c8a253bd8c274cc9e1213b885f1e6d27c86e5a04153d6303424a9cc8d4018
SSDEEP

192:QBIf94gd1x7TMMBC2uy8A5XATGh420RLrlKjcAgo2l8fiI1SuDCpiH4q:sIVP77TMMBCZy8/THPzAguKIsvpiHx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2528	1048	rundll32.exe	14
PID 1048 wrote to memory of 2528	1048	rundll32.exe	14
PID 1048 wrote to memory of 2528	1048	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4349ac48408f0238514ea7ba1c5736f2.dll,#1
1⤵
PID:2528

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4349ac48408f0238514ea7ba1c5736f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048