c5773d87542b9e0ab138d483894fb69c5e524ea6a2609555f87d32f291bfd54b

Analysis

max time kernel
100s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 08:26

Target

11e93b5ce7835fb8a69ec0f98828caa0.dll
Size

8KB
MD5

11e93b5ce7835fb8a69ec0f98828caa0
SHA1

5538cea0a1aed5426a0e7e26e66ffe6cba9da0dc
SHA256

c5773d87542b9e0ab138d483894fb69c5e524ea6a2609555f87d32f291bfd54b
SHA512

79c0abe91e928e583c838ee3c89534e5698968fdda95ebc2c6ae305c65a7b501a1e69339287314137fa3cd64592a0f4771973c65c4b339b32774f95738298bf2
SSDEEP

96:tAG0z/lPlNr092UYpAbpzw8Wt52WDxTCGeEQjIQOrj+kqvyU5S:8FlNr092U+Abe848arj9qqU5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 1812	3692	rundll32.exe	87
PID 3692 wrote to memory of 1812	3692	rundll32.exe	87
PID 3692 wrote to memory of 1812	3692	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11e93b5ce7835fb8a69ec0f98828caa0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11e93b5ce7835fb8a69ec0f98828caa0.dll,#1
  2⤵
  PID:1812