65d64ef8ed33bb1d021dcbe0db9481c816f8b557fdc0bcaae85dbc4e8d3c8b84

Analysis

max time kernel
133s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 20:51

Target

3c50685b6cb7ef7dda95fbe882d0632c.dll
Size

141KB
MD5

3c50685b6cb7ef7dda95fbe882d0632c
SHA1

515e5c14ac7b6c6723f4f1b886cb748972c6c2f2
SHA256

65d64ef8ed33bb1d021dcbe0db9481c816f8b557fdc0bcaae85dbc4e8d3c8b84
SHA512

e86900d0888c0779e85eb240716aeb952bb02bec94f225befa1b90d86306ec7ba0f726e8254110430e57b172bcc7e1de6af8daa88de38660609716e49ca57ebb
SSDEEP

3072:RECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:REvgOP17s/F08OaoCC1vl1V

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 3816	5104	rundll32.exe	17
PID 5104 wrote to memory of 3816	5104	rundll32.exe	17
PID 5104 wrote to memory of 3816	5104	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c50685b6cb7ef7dda95fbe882d0632c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c50685b6cb7ef7dda95fbe882d0632c.dll,#1
  2⤵
  PID:3816