cb842d68195e016e9070230278516ec7164e46ddb09bf7dcce1d90637828aee2

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 04:52

Target

55b197c57e15a0a4514d2a1287899321.dll
Size

103KB
MD5

55b197c57e15a0a4514d2a1287899321
SHA1

e09fe69f6fc4ee10ccee40fc09601a9e1d57a045
SHA256

cb842d68195e016e9070230278516ec7164e46ddb09bf7dcce1d90637828aee2
SHA512

8b48c86fd47ce6f6b0e6300e25659b496294ddff2a0b111bd0d3dc8549288e01b82476f2a9000bfe1ba75b6ddd5b46e8c84d83475b64d78b7156a8d639e3f9e8
SSDEEP

1536:89QxWo/u/TRqG8I8I8WbWx0uqL14r3wFjkkqeSD66BYVN6V2wqFUbJJRTOHS:/WX/EGXLar3wt9P+2s7RaS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3584	5088	rundll32.exe	12
PID 5088 wrote to memory of 3584	5088	rundll32.exe	12
PID 5088 wrote to memory of 3584	5088	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55b197c57e15a0a4514d2a1287899321.dll,#1
1⤵
PID:3584

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55b197c57e15a0a4514d2a1287899321.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088