f007a85d515be9539df75be252a00ef953acb68db4538f29bf5eda74d2b9262a

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 10:07

Target

660b7f631767ea6a40412b3432ec04f4.dll
Size

29KB
MD5

660b7f631767ea6a40412b3432ec04f4
SHA1

4fe03b4cf0895cba1fa271c3967b6020dcebce39
SHA256

f007a85d515be9539df75be252a00ef953acb68db4538f29bf5eda74d2b9262a
SHA512

65789aa91639d76d398a2a963305fdff9aced892a3515f13951b2ed083c26b8429da9c78a71dbcb2f864e21bf2e8a1adc3313852f2ad295a20f580d3637190ca
SSDEEP

384:s8AHxUSoquj/BKnGQqTqz/Df89RnFLT2Q48SQmWrKZUSOWUelpx/Rc3+3UwAzuW9:aKSoqubB0GQhzr89qISaeZ5uvVuWo1o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3688	2304	rundll32.exe	16
PID 2304 wrote to memory of 3688	2304	rundll32.exe	16
PID 2304 wrote to memory of 3688	2304	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\660b7f631767ea6a40412b3432ec04f4.dll,#1
1⤵
PID:3688

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\660b7f631767ea6a40412b3432ec04f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304

memory/3688-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download