47cff82a82bc56c6df09399d1a8daf05d997c0696d693359a7c7fe616754014b

Analysis

max time kernel
141s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:08

Target

4b9859f459ea6e823907dc124f47620a.dll
Size

144KB
MD5

4b9859f459ea6e823907dc124f47620a
SHA1

3304fed8fb8bee6e64f1f583e55b390284c7f953
SHA256

47cff82a82bc56c6df09399d1a8daf05d997c0696d693359a7c7fe616754014b
SHA512

aec705744eabd785f178f2bfd488dbc419bc1c7b45b61e74b4b08b2071ccb965cfc912014ff67b1c2f0ad22cc73fe2dd4e0dc559b62dd9cdf3bf6b325325bf57
SSDEEP

3072:+VKwMCY/bzuZpbfmpVKxgsIRZzGGijqEulGeG3z9N4:+VKwtY/mvqV5/jXijhulGeG3z34

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 5080	772	rundll32.exe	14
PID 772 wrote to memory of 5080	772	rundll32.exe	14
PID 772 wrote to memory of 5080	772	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9859f459ea6e823907dc124f47620a.dll,#1
1⤵
PID:5080

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9859f459ea6e823907dc124f47620a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772