fd1e96e20ca5896e520ca7e9c6da6789b11667424453ad9e03b27c618ec00eb4

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 14:15

Target

24afd5783d74142a7da97e5b328f407b.dll
Size

152KB
MD5

24afd5783d74142a7da97e5b328f407b
SHA1

93ac8149654b60c608a3c9ee8b3e9eb6370651bf
SHA256

fd1e96e20ca5896e520ca7e9c6da6789b11667424453ad9e03b27c618ec00eb4
SHA512

6220e0097705528a883920bc81c4cf8b7b1e34129af68c5f3b9ea1451b993b0672804e1df05abeecc7559ef94358fc8e06fd7f9ec000390b8b5cf64f50767a1d
SSDEEP

3072:5kU2f5imM1aX1vrGmaDwfT7294Z6ScDh5G5galRQQyWlOQ/:5kU2AmSaXVGmicU4T6fYgTWlOQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1220	2448	rundll32.exe	14
PID 2448 wrote to memory of 1220	2448	rundll32.exe	14
PID 2448 wrote to memory of 1220	2448	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24afd5783d74142a7da97e5b328f407b.dll,#1
1⤵
PID:1220

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24afd5783d74142a7da97e5b328f407b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448

memory/1220-4-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/1220-0-0x00000000009C0000-0x00000000009CA000-memory.dmp

Filesize
40KB

Download