6c785f39e4ae4779a3e4cbc0cc216398f51926bb3a11ec5bfd1534352abaabfa

Analysis

max time kernel
147s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:10

Target

4bba508e94d309077e4013f28c96a19c.dll
Size

101KB
MD5

4bba508e94d309077e4013f28c96a19c
SHA1

0bda85454df4e545c5004c85037032229112cdc5
SHA256

6c785f39e4ae4779a3e4cbc0cc216398f51926bb3a11ec5bfd1534352abaabfa
SHA512

66a49dd309561bfa1bba3810e1ed6a23843f3466fe750506c9bf728c84f3cfcb4e3387757e381524b0ba35d80964d96c39a1500a22abdca6c1c69d06585be86e
SSDEEP

1536:mzHTYzlIJg60dxkdIv6jGIfK2pGTEwn1+5r+GBY8UlEj5UENCG:YzAlIJlSyv5u3GB5tj5UVG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2248	4716	rundll32.exe	14
PID 4716 wrote to memory of 2248	4716	rundll32.exe	14
PID 4716 wrote to memory of 2248	4716	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bba508e94d309077e4013f28c96a19c.dll,#1
1⤵
PID:2248

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bba508e94d309077e4013f28c96a19c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4716