5e30419557fd45bb69db4cc40e1c656a6500321eb61c948c92c0ce56a3f6b275

Analysis

max time kernel
141s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:19

Target

2c967c44deb13bf1ab8371797750bdf9.dll
Size

7KB
MD5

2c967c44deb13bf1ab8371797750bdf9
SHA1

5d35a51b5a6672b35afeeb2f4037a8a593cb5739
SHA256

5e30419557fd45bb69db4cc40e1c656a6500321eb61c948c92c0ce56a3f6b275
SHA512

6d8deb14f673a9b37398200af4ca14cc7ae4342dc791f66289f9a91d3e3add23f8b1f19088986abe249db6dfc62e6aed6c5d84c42d3b6b903f77df9297efda8e
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW9bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPPq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1904	2640	rundll32.exe	14
PID 2640 wrote to memory of 1904	2640	rundll32.exe	14
PID 2640 wrote to memory of 1904	2640	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c967c44deb13bf1ab8371797750bdf9.dll,#1
1⤵
PID:1904

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c967c44deb13bf1ab8371797750bdf9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640