e5f19c451a4a1ede6b921522d74bca02b3e5fd9145e48aa99618a6eb2a4e09bc

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 01:18

Target

48b1e145409d09e3b3c803b1bf5a6bcc.dll
Size

118KB
MD5

48b1e145409d09e3b3c803b1bf5a6bcc
SHA1

453c585d614cccf6e7b07d8b53e0303f11c7928b
SHA256

e5f19c451a4a1ede6b921522d74bca02b3e5fd9145e48aa99618a6eb2a4e09bc
SHA512

d5905cc4c6900cadf375c2e9110212b31f3950d960cdfab96c469bf483fbafd6f58c4791c4575dff9869b5e109ab6a11147b4cc8cdcc5ad4518dbd6ea3418231
SSDEEP

3072:N4JUn2SF5by3Dwkl7LUpDaIdtdsYrRxvU3o3rsBAUQQiKl:6Wn2Ee3DBwuIdt7vU2bQiKl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1348	4912	rundll32.exe	14
PID 4912 wrote to memory of 1348	4912	rundll32.exe	14
PID 4912 wrote to memory of 1348	4912	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48b1e145409d09e3b3c803b1bf5a6bcc.dll,#1
1⤵
PID:1348

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48b1e145409d09e3b3c803b1bf5a6bcc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912