12b0ba2ad3c470acf96218e9d41f2399ac0c9995faef46bdc3eccf4a201dccc7

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 17:06

Target

2f8d27bb4a56bd1c0f6107d5c758bfa6.dll
Size

192KB
MD5

2f8d27bb4a56bd1c0f6107d5c758bfa6
SHA1

d73f88145354c38b61a73f8cd1f588246822c021
SHA256

12b0ba2ad3c470acf96218e9d41f2399ac0c9995faef46bdc3eccf4a201dccc7
SHA512

083228e0fcbd20ab465525209f3cf7bbf45778b0d5081bd9b7d82584d4c10427a57394a89e68ea391fb653d809d261e2df3f4de0cf03f7efb5b67c3449d1d869
SSDEEP

3072:fNbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrm9:fNbqaLD7RcukVAtSQOWcgWqbV77Lm9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1360	3620	rundll32.exe	14
PID 3620 wrote to memory of 1360	3620	rundll32.exe	14
PID 3620 wrote to memory of 1360	3620	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f8d27bb4a56bd1c0f6107d5c758bfa6.dll,#1
1⤵
PID:1360

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f8d27bb4a56bd1c0f6107d5c758bfa6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3620