6838f818e9244445530f51df05a9f26f0a3758f58fc45c9d5d22223808cc8120

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:42

Target

79c42c1cd0c4a1a91ba270a92a9cad63.dll
Size

115KB
MD5

79c42c1cd0c4a1a91ba270a92a9cad63
SHA1

4d8ad17d3bb2ef3b51e2a887499ed5ea040bdda3
SHA256

6838f818e9244445530f51df05a9f26f0a3758f58fc45c9d5d22223808cc8120
SHA512

bb9e6e894443b9940c76f34f24a861b32ae4d4c74afa742f8ce59bd7cbec8a2803177d5e3ed9a22c036002d864f416182bb970a51ec22f4288a38948995cffe5
SSDEEP

1536:sjkkJP0df45rr04ZSCB3quf06F/xRjvlZagwM3HD:sIkJP0df45rIaB06FphvlZagf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4908	868	rundll32.exe	14
PID 868 wrote to memory of 4908	868	rundll32.exe	14
PID 868 wrote to memory of 4908	868	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79c42c1cd0c4a1a91ba270a92a9cad63.dll,#1
1⤵
PID:4908

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79c42c1cd0c4a1a91ba270a92a9cad63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868

memory/4908-0-0x0000000000810000-0x0000000000819000-memory.dmp

Filesize
36KB

Download