3e4e4ffd171a9becd3b92f16b12f36cc8b0e76f3d8e86c72480d4ac1feb7a0a8

Analysis

max time kernel
142s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 10:24

Target

16fb09c3748cb9b24b828a4e91f5813c.dll
Size

336KB
MD5

16fb09c3748cb9b24b828a4e91f5813c
SHA1

8471d6957f35507c838d0e886d7abd4e3eeb02be
SHA256

3e4e4ffd171a9becd3b92f16b12f36cc8b0e76f3d8e86c72480d4ac1feb7a0a8
SHA512

6b10ab99d511c24717a69b4b7cecb6523a612a75daee02f474e9d07b92c21671af430778e3a4c586aa40ba3418d6163bd908aa3a01a2261200caa95050705147
SSDEEP

6144:js8c6PmMIKg/fYkHpAWOKqjNUiLYzEAQ1/G9cyEjP/wj6dmsVqXERmSciw8:js8c5MI/nihjP1/G7s/weQ/G

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 3084	3856	rundll32.exe	89
PID 3856 wrote to memory of 3084	3856	rundll32.exe	89
PID 3856 wrote to memory of 3084	3856	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16fb09c3748cb9b24b828a4e91f5813c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16fb09c3748cb9b24b828a4e91f5813c.dll,#1
  2⤵
  PID:3084

memory/3084-0-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download