eb0c249482c227c95d4022ef85d6144d680c3d766a6d9cdaad3f4ef4967b6a41

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 00:19

Target

45ddf9e40fe2a0236bbc93efdae9adb5.dll
Size

92KB
MD5

45ddf9e40fe2a0236bbc93efdae9adb5
SHA1

039db6e250b38ed7ec4fad99a1fdcba7c106cb47
SHA256

eb0c249482c227c95d4022ef85d6144d680c3d766a6d9cdaad3f4ef4967b6a41
SHA512

ecfc99518074be32a7f9e12f87c23a6c76fc15fc8c31d00ed4ff7c52179bfb54729fa957781634c751d9b14d25bfa63ec3dabd325bdffa6e00c4e7ec65dc46b6
SSDEEP

1536:gdDFGePKcLPkXeRgHTJYDbv4BH0K36ACaxos2lqADQeVnAQJ/vCcRczshir0:gmePKcLMXePOU66ACaxozx8eNfKcqzsr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1536	4400	rundll32.exe	14
PID 4400 wrote to memory of 1536	4400	rundll32.exe	14
PID 4400 wrote to memory of 1536	4400	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45ddf9e40fe2a0236bbc93efdae9adb5.dll,#1
1⤵
PID:1536

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45ddf9e40fe2a0236bbc93efdae9adb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400