e073a55d6e8570265b8b150ff6874051eeae6ddca1e9bfe3e2179b30e8702d38

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 14:06

Target

7448f3324d30b9d0f07e399bd0f2dd2f.dll
Size

179KB
MD5

7448f3324d30b9d0f07e399bd0f2dd2f
SHA1

7f41dcbb54bed07d21afac93c9f21496dbfba9e8
SHA256

e073a55d6e8570265b8b150ff6874051eeae6ddca1e9bfe3e2179b30e8702d38
SHA512

90552d7278ab77cb3d9cd12d5bfa1de806c39d0939cb3149f6996e57c1e08ae1ef7ae64c6694b5aa3f29fe3471c12f51417024b4b2b93bed53d0835fdfb800b0
SSDEEP

3072:+eTSg1mUo9Pp1K7MyO56ERiNe/3S4aHNdnY8yua5MDoBQeeaQeeY4QeesQeeGeQW:bj1m7RF56Qio/paHoTBQeeaQeeY4Qeep

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3784	4852	rundll32.exe	14
PID 4852 wrote to memory of 3784	4852	rundll32.exe	14
PID 4852 wrote to memory of 3784	4852	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7448f3324d30b9d0f07e399bd0f2dd2f.dll,#1
1⤵
PID:3784

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7448f3324d30b9d0f07e399bd0f2dd2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852