e060b66885b4431572dc166d703aeec4185a5cb388e21f4219379e09910508b4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 06:15

Target

58f7de614e56db152175e8407dd1ded2.dll
Size

116KB
MD5

58f7de614e56db152175e8407dd1ded2
SHA1

3f8a0a831cc7d0c1e7797d9d233bbba6b37aba69
SHA256

e060b66885b4431572dc166d703aeec4185a5cb388e21f4219379e09910508b4
SHA512

95ce78e12a7359f7941728a2148d8f275f826dc9ffd95809ee803bfdb465620af5e1f0a361e46a00894d69f660dafd38bd6fd4b68b1a45fbd1a5d80c3a2f202d
SSDEEP

1536:cea1sET+HX4hJx4l7pOe+FhgVk+/MiIjnowxisoOF6aSAalEU:cJK8+HX4hupOReV8iygsow6KalEU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 5612	1564	rundll32.exe	14
PID 1564 wrote to memory of 5612	1564	rundll32.exe	14
PID 1564 wrote to memory of 5612	1564	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58f7de614e56db152175e8407dd1ded2.dll,#1
1⤵
PID:5612

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58f7de614e56db152175e8407dd1ded2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564

memory/5612-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5612-2-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/5612-1-0x0000000001100000-0x0000000001112000-memory.dmp

Filesize
72KB

Download
memory/5612-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5612-5-0x0000000001100000-0x0000000001112000-memory.dmp

Filesize
72KB

Download