4d2e8aa62a9139afe354cb4c32ab8516cc1d659b89819ab8a03b0bd39da0b8d3

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 00:28

Target

1cebc0073c91ee405008d21d0680f6d3.dll
Size

53KB
MD5

1cebc0073c91ee405008d21d0680f6d3
SHA1

c9c7ad3bb8e566b4e70462fe7b52d2f70fc31ec4
SHA256

4d2e8aa62a9139afe354cb4c32ab8516cc1d659b89819ab8a03b0bd39da0b8d3
SHA512

191bbb2a0669d8c0c3cf6ea4ab4d98f325650a11b2d9fbc5ada0fa84f0580894e8bdfd9c06f67bf9cff563b80a90cae59e6584f094133b01a799393c7d8777b4
SSDEEP

1536:TmiKOp/l0DeD8k9NC+AwsifEtBB76784ieiuylPOtHsV8:TmPONl0DeD8kDLfipTOtHM8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3368	4804	rundll32.exe	14
PID 4804 wrote to memory of 3368	4804	rundll32.exe	14
PID 4804 wrote to memory of 3368	4804	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cebc0073c91ee405008d21d0680f6d3.dll,#1
1⤵
PID:3368

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cebc0073c91ee405008d21d0680f6d3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804