101e112ee627493b47798148d36b25a613e475b12ccc13f65b04874fd15d0433

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:11

Target

1d53a4149cbe4d24be61eacbce164aef.dll
Size

192KB
MD5

1d53a4149cbe4d24be61eacbce164aef
SHA1

645046aa68fe78504a0a0e6cbe5b14a9df827daa
SHA256

101e112ee627493b47798148d36b25a613e475b12ccc13f65b04874fd15d0433
SHA512

f3ccece376db17f36c91ff2fee8b312b73b43ac2eeac6a3ec3f759760362a593aef5cbd9dd4339b85496b43171ce540c0352cf8b288a6594fb14152bda5dddbc
SSDEEP

3072:vNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/HrmL:vNbqaLD7RcukVAtSQOWcgWqbV77LmL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 5056	1508	rundll32.exe	87
PID 1508 wrote to memory of 5056	1508	rundll32.exe	87
PID 1508 wrote to memory of 5056	1508	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d53a4149cbe4d24be61eacbce164aef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d53a4149cbe4d24be61eacbce164aef.dll,#1
  2⤵
  PID:5056