31d28632c24fbc258414cb1ae84e928c024383a9ae7ea04a59f84213d737e452

Analysis

max time kernel
113s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:44

Target

12d00e4c55f13b0a90eb94eb235206d6.dll
Size

20KB
MD5

12d00e4c55f13b0a90eb94eb235206d6
SHA1

14823c439cb5b629efc9b211c46524e62f50c5b8
SHA256

31d28632c24fbc258414cb1ae84e928c024383a9ae7ea04a59f84213d737e452
SHA512

213421cc7c15f112e13208523095db5a18d5f4eb1a769a6dbb851c32d79c90755960077a88d7d938ba8a6683d4500046b8692ba362806305f4e7b763c9b89e36
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplcDCAu8UaWHuqaTlX0wG:zfYh2oCtpXPcDx2OqaewG

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3856	rundll32.exe
3856	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3856	1208	rundll32.exe	14
PID 1208 wrote to memory of 3856	1208	rundll32.exe	14
PID 1208 wrote to memory of 3856	1208	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12d00e4c55f13b0a90eb94eb235206d6.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3856

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12d00e4c55f13b0a90eb94eb235206d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208