ca80386ecca48067f669f4642ecada45d653ba812ef6a04fca39d4007956a818

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2023, 00:07

Target
980456d71fe0eede34aea2afcadb115a.dll
Size 54KB
Sample231227-aebnxaggdj
SHA256 ca80386ecca48067f669f4642ecada45d653ba812ef6a04fca39d4007956a818
MD5 980456d71fe0eede34aea2afcadb115a
SHA1 38547f1e8000cf42db1c24128fb032664852fd96
SHA512 519ba6a2375ca277870ae61119e7fe0279c4c69994197f74d1e38834ca7521577025d9914e454f1a22a266434624f6c52b01c1bc4820b460f51fa622c8d7f727
SSDEEP 768:KNSqqNzctnK75oVkfn6fPo/auD/z3zyN7/V8XG5nTjJrK4nsbiPA/qT+45JpQ6:FqqNz0K7N6qpDA5yG5nTjUtWSW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4800	4352	rundll32.exe	88
PID 4352 wrote to memory of 4800	4352	rundll32.exe	88
PID 4352 wrote to memory of 4800	4352	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\980456d71fe0eede34aea2afcadb115a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\980456d71fe0eede34aea2afcadb115a.dll,#1
  2⤵
  PID:4800