e8f21877da3c5c0f43331121c8c09c1061c149d0dbabf917fbf50bc5867a2939

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 18:42

Target

354be1f52915da980966c4eacd0b250f.dll
Size

358KB
MD5

354be1f52915da980966c4eacd0b250f
SHA1

45347b283fe01e50f17c3b0a84962531f585355c
SHA256

e8f21877da3c5c0f43331121c8c09c1061c149d0dbabf917fbf50bc5867a2939
SHA512

a0436b65cfd7774264a5c21cb9ebdcdfb7e00d1d02ca2d6edc02eeff4cf9c3ad74329e196259c48f4d5a79ef23324ad599f8604a6d03c7b1a8eee46632385c7b
SSDEEP

6144:DHdflwj6nH2S/cLZifj3WBKOwOW6N51M8pXTTdSZTk3PD8:DHduj6H2NVN5C81fdSZTk3Pw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4296	4804	rundll32.exe	16
PID 4804 wrote to memory of 4296	4804	rundll32.exe	16
PID 4804 wrote to memory of 4296	4804	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\354be1f52915da980966c4eacd0b250f.dll,#1
1⤵
PID:4296

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\354be1f52915da980966c4eacd0b250f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

memory/4296-1-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/4296-0-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download