0b3e1026408effc04cbc6efa2e1f41c846b59bae434c187e44948230d6af87fd

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 05:06

Target
569f1a44260f85ed9d900a1a85591a44.dll
Size 34KB
Sample231226-frpn7abbc4
SHA256 0b3e1026408effc04cbc6efa2e1f41c846b59bae434c187e44948230d6af87fd
MD5 569f1a44260f85ed9d900a1a85591a44
SHA1 7505f1c298acbd7e67f9bf14edcf0fb252802c9f
SHA512 cab96ccf4ef6f32e1494a697c817420ba8f0ba010e5ee4ba805054c6378173dad595bd19833c53c5fbb5534cb29879a717509e39a4a3ca48ebd7f3d46746c139
SSDEEP 768:ha8lahZqQdUpHvEPp6w7p/ANZm2OVORi838X5:ha8cOpH8hb7p/AbfRw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 5060	2708	rundll32.exe	14
PID 2708 wrote to memory of 5060	2708	rundll32.exe	14
PID 2708 wrote to memory of 5060	2708	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\569f1a44260f85ed9d900a1a85591a44.dll,#1
1⤵
PID:5060

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\569f1a44260f85ed9d900a1a85591a44.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708