2335b476e6e9b3ae5959761ea1a39f2b899495f9e535e81256e3b068f853374d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:22

Target

1c9e2027c69d6b98ba878bc5d3c2f46b.dll
Size

840KB
MD5

1c9e2027c69d6b98ba878bc5d3c2f46b
SHA1

2c58ae516f2ad16e119544d86841417258de3d77
SHA256

2335b476e6e9b3ae5959761ea1a39f2b899495f9e535e81256e3b068f853374d
SHA512

e305d7b375d01a81cd2c9810aa58b8f73c6ea7795b9c9b9e4e20043528b7cc315765e12c1833b11171412b50722f18c09fd548da7de0f48530bf2756bc4441ba
SSDEEP

12288:6a2rlp6vp+awfvjeZ0cu43l/whtnORAOHSfIZoooHctRsvyz:6aaSp+RzFhuk8nSfyooIw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 872	5028	rundll32.exe	14
PID 5028 wrote to memory of 872	5028	rundll32.exe	14
PID 5028 wrote to memory of 872	5028	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c9e2027c69d6b98ba878bc5d3c2f46b.dll,#1
1⤵
PID:872

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c9e2027c69d6b98ba878bc5d3c2f46b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028