13bc1fee1b0ce2f84025444bc1c164e0c562deba06bab419b408bc067cb4822a

Analysis

max time kernel
87s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 10:25

Target

170c397e976a9eeb97b02a390a0f5fdc.dll
Size

192KB
MD5

170c397e976a9eeb97b02a390a0f5fdc
SHA1

dc2e75ec2816fbec12b57298e6696540f2d7a7d7
SHA256

13bc1fee1b0ce2f84025444bc1c164e0c562deba06bab419b408bc067cb4822a
SHA512

9ece4b29392d6f1586445389e27a40cb2ad694bc044f1e2a7bd1a11a8385736a652ae804b2569c6c7bc9804ec75a98f885c81eb820f6dd1367f186c0c5c60064
SSDEEP

3072:ENbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrms:ENbqaLD7RcukVAtSQOWcgWqbV77Lms

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4508	4828	rundll32.exe	87
PID 4828 wrote to memory of 4508	4828	rundll32.exe	87
PID 4828 wrote to memory of 4508	4828	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\170c397e976a9eeb97b02a390a0f5fdc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\170c397e976a9eeb97b02a390a0f5fdc.dll,#1
  2⤵
  PID:4508