494ebf40496f1683b9a8b83c353876120c785a84a4727874d53dd5301e4a77f1

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:08

Target

1d1e4f4bd11c94a570c06b0ef9eefd61.dll
Size

87KB
MD5

1d1e4f4bd11c94a570c06b0ef9eefd61
SHA1

323ccdcc534bbcd5a4f98a4b2b4b8aa20b212d5e
SHA256

494ebf40496f1683b9a8b83c353876120c785a84a4727874d53dd5301e4a77f1
SHA512

174bf26198c192a166beac894eedb38c335b5c9730187f9d533274ad8e9b46610fb6b654667b753b916631dfebd1fa9be61e035520e565bd287cc2c2d67ef862
SSDEEP

1536:Qezi2W74vpdIZAj4yrjxqey6aDX+EMDah5W+BC/HkLWbU:QezI0dIZAj44gqaSh2hdBCcLiU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3952	4628	rundll32.exe	14
PID 4628 wrote to memory of 3952	4628	rundll32.exe	14
PID 4628 wrote to memory of 3952	4628	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d1e4f4bd11c94a570c06b0ef9eefd61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d1e4f4bd11c94a570c06b0ef9eefd61.dll,#1
  2⤵
  PID:3952