76ef59c7bf4a31f9b7180b9d9aba083e0307f296c743347b420ab46ceaac0293

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 10:39

Target

67f171622a3bc4ef70de58d3c3af2787.dll
Size

8KB
MD5

67f171622a3bc4ef70de58d3c3af2787
SHA1

aadbdf65c08ef3c2d38004ba019d3101fa862511
SHA256

76ef59c7bf4a31f9b7180b9d9aba083e0307f296c743347b420ab46ceaac0293
SHA512

5543af89e02f217e5f509d12118e0a69394f3730dcb9e995913e5d11263662739b3f09a72ae583f8f3f229700be0f661f4c894405f8a3286e30f7fee39418b4e
SSDEEP

96:pcV1Ammn/0jl+6MqMxj2vYZQ0hTphJ2AFkkXn3XAaVAAD6jOtJZKoi89C7tCEv/:i1U2tJUxZHRZn3XJVlD6sZ4v

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4064	2072	rundll32.exe	12
PID 2072 wrote to memory of 4064	2072	rundll32.exe	12
PID 2072 wrote to memory of 4064	2072	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67f171622a3bc4ef70de58d3c3af2787.dll,#1
1⤵
PID:4064

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67f171622a3bc4ef70de58d3c3af2787.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072