4378d574c2ed0a04af0c0f2b30ce64445fe0175b86e5046972c50be4e637846a

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:59

Target

27934fa545f1221dcd66f652128aad70.dll
Size

33KB
MD5

27934fa545f1221dcd66f652128aad70
SHA1

c992f5747d25780dc759d53d839c175d11ea33b8
SHA256

4378d574c2ed0a04af0c0f2b30ce64445fe0175b86e5046972c50be4e637846a
SHA512

9d06c0fe2afd827cb6ad766069b7973a652dab902b457696766d9d507de25b5adf01b69de6042c17fd74078d8fc4e018a4ea17c12142bf5b1bed5cc730826266
SSDEEP

768:r0ceyVVtUn0J4gaed7hB7vrcFDfPta4SqO8dtR8spkU:r0cXVn1ael7vrctfP5R1pX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1656	4976	rundll32.exe	16
PID 4976 wrote to memory of 1656	4976	rundll32.exe	16
PID 4976 wrote to memory of 1656	4976	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27934fa545f1221dcd66f652128aad70.dll,#1
1⤵
PID:1656

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27934fa545f1221dcd66f652128aad70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976