47ced2bfd3b5b099d3ee70e4917be52f947cddcfd1c8becc428bd8f19c9671d9

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 13:42

Target

229fa6904b67fc0cfe652b83343089bd.dll
Size

437KB
MD5

229fa6904b67fc0cfe652b83343089bd
SHA1

b9240c2d253ab26386ac93c578b3c0b6ba2017b0
SHA256

47ced2bfd3b5b099d3ee70e4917be52f947cddcfd1c8becc428bd8f19c9671d9
SHA512

8f79b3b36f32a685f013e7e68a372f4a29460e7e20ea319a330b03bb97e2ce51986e3355d38e5c22fec161ccc8325634a98dfb8b619faf494562a57ff365a934
SSDEEP

6144:U3SrsbB3SeJZWUdgU59z23GvkomNCufNP4WLzOsYCsiing7AcIf5Bv8KMKG:jrquag4z235oWfNP4Wu6grcUnvd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2908	548	rundll32.exe	15
PID 548 wrote to memory of 2908	548	rundll32.exe	15
PID 548 wrote to memory of 2908	548	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\229fa6904b67fc0cfe652b83343089bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\229fa6904b67fc0cfe652b83343089bd.dll,#1
  2⤵
  PID:2908

memory/2908-1-0x00000000028C0000-0x0000000002930000-memory.dmp

Filesize
448KB

Download
memory/2908-7-0x00000000028C0000-0x0000000002930000-memory.dmp

Filesize
448KB

Download
memory/2908-10-0x0000000002850000-0x00000000028B5000-memory.dmp

Filesize
404KB

Download
memory/2908-9-0x00000000767E0000-0x00000000769F5000-memory.dmp

Filesize
2.1MB

Download
memory/2908-6-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2908-5-0x00000000028C0000-0x0000000002930000-memory.dmp

Filesize
448KB

Download
memory/2908-0-0x0000000002850000-0x00000000028B5000-memory.dmp

Filesize
404KB

Download