5b920d9879debea24effd832b1f48176a2824023826e481a8448857a9a9262f6

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 07:41

Target

0f9dda097cde6a275f60f6463b96aa1f.dll
Size

84KB
MD5

0f9dda097cde6a275f60f6463b96aa1f
SHA1

3ef2a3de6b89654e9c7a2bf4ba344bf40e92e0f0
SHA256

5b920d9879debea24effd832b1f48176a2824023826e481a8448857a9a9262f6
SHA512

cd096eca97dd21b62609d4be97a481b4a29fcd1c260b48f02454eabb58e250a85f5f122806bb9207063627ad15781d6d7064fde5dd277d690ce2b17a61cfe3fe
SSDEEP

768:MaFJam9WkwsbWRtzGFHGvh/Lk9xWKZlZJgJw0vZqBee/0qeXRpt1R9X760ALdeb:34kwjuHGZ/LURvPgu04X/0qeBpH3UY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4132	1964	rundll32.exe	70
PID 1964 wrote to memory of 4132	1964	rundll32.exe	70
PID 1964 wrote to memory of 4132	1964	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f9dda097cde6a275f60f6463b96aa1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f9dda097cde6a275f60f6463b96aa1f.dll,#1
  2⤵
  PID:4132

memory/4132-0-0x0000000000B90000-0x0000000000B9D000-memory.dmp

Filesize
52KB

Download
memory/4132-2-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/4132-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/4132-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download