fb33c30733531dc9bdd88ade5a7206e3e7f7f563ae46d5532ac356f57d84dde6

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 06:01

Target

0a0af3e77221ce26d4b3ca1bd0a0f36d.dll
Size

7KB
MD5

0a0af3e77221ce26d4b3ca1bd0a0f36d
SHA1

1322dc4ebc3d8a2f3e33d41976102afbf7d28e74
SHA256

fb33c30733531dc9bdd88ade5a7206e3e7f7f563ae46d5532ac356f57d84dde6
SHA512

2f6de6b5a8e68868bf2a45507c9584eb96a8aa9a5822b9526a0e4c2abbe2cf8c10454f4b9c52b2f5e3c71b09b90ba17783e71fdbb21a5c9815796e2e397a5ec5
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWNQUbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbP+Kq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 2344	4452	rundll32.exe	88
PID 4452 wrote to memory of 2344	4452	rundll32.exe	88
PID 4452 wrote to memory of 2344	4452	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a0af3e77221ce26d4b3ca1bd0a0f36d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a0af3e77221ce26d4b3ca1bd0a0f36d.dll,#1
  2⤵
  PID:2344