e809a8893b6c0cc0eb04fabc67c9e2cbfe7806113cc2e20d279946b0f69398fe

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 15:28

Target

295dbe9a386d8af87d38d04b6e7cac8b.dll
Size

364KB
MD5

295dbe9a386d8af87d38d04b6e7cac8b
SHA1

1b207e6741994a9527f0ea32c54e1ab4d66070e8
SHA256

e809a8893b6c0cc0eb04fabc67c9e2cbfe7806113cc2e20d279946b0f69398fe
SHA512

e18aed348ffc6c0da0f89e1dc7a5eba097d7e38b78035447522ab8ad905e8432042203348df4fcef8c4b65286af80b66064fd5e164bba1e5a5a0b88c35e5f467
SSDEEP

6144:SnilbOMzkUxD7AHvMQwT96fGqB5EEcZ48JJfYQvokQ38OXTBNNj:SixOsvRpXZrtRAkQ3XBNNj

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3568	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 3568	688	rundll32.exe	88
PID 688 wrote to memory of 3568	688	rundll32.exe	88
PID 688 wrote to memory of 3568	688	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\295dbe9a386d8af87d38d04b6e7cac8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\295dbe9a386d8af87d38d04b6e7cac8b.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3568

memory/3568-1-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/3568-0-0x0000000002720000-0x0000000002820000-memory.dmp

Filesize
1024KB

Download