d006417a9aeb0ef6edfdf96feff2abbef3db4100020f59e04209aac71f534de1

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 10:13

Target

16604b210d153b8627e1edb8bb42af27.dll
Size

66KB
MD5

16604b210d153b8627e1edb8bb42af27
SHA1

c9fdac73bd1fd9fc4d95558e61a865f1e8fb852b
SHA256

d006417a9aeb0ef6edfdf96feff2abbef3db4100020f59e04209aac71f534de1
SHA512

811f34dfb7cfaeb8c475889a28b61d6898ede30628bf137dbfccb9247a59f466f277c98e8d6937671cc1a9e934daac70d99a7bc4e54f91f0aaf6064038e75186
SSDEEP

1536:iX0BuUcH9OGPKEQH7ukaclBxt+9l+es0Umcg:KsuUcH9OSKz7ukaclB/+9l+wUmcg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2756	2964	rundll32.exe	74
PID 2964 wrote to memory of 2756	2964	rundll32.exe	74
PID 2964 wrote to memory of 2756	2964	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16604b210d153b8627e1edb8bb42af27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16604b210d153b8627e1edb8bb42af27.dll,#1
  2⤵
  PID:2756

memory/2756-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download