0bcb31981e2f7fcc498a80b665948f77eb00d3046844d67af34e3970d47dd746

Analysis

max time kernel
165s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:14

Target

fc109dad7efe49b51c5360b6bdfb46fc.dll
Size

32KB
MD5

fc109dad7efe49b51c5360b6bdfb46fc
SHA1

dc3e31f8484e5903e8efcf1cd82b947b34803958
SHA256

0bcb31981e2f7fcc498a80b665948f77eb00d3046844d67af34e3970d47dd746
SHA512

6ad8003059fba8cb5d1cff9a98bcbe5574f31a4e44fda6dbf11ae2ad8e73a16b8a0d8b95b409e02e4fae203782aba66744455ea9cb0a2a5a5f17ac3af4a937f1
SSDEEP

768:gzPG3w/lNz1iB42xQkua29TM8JfKQcQKMX916iMhFBjZNk:Ha0x/d2biEKMt16iMvVZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4848	5096	rundll32.exe	91
PID 5096 wrote to memory of 4848	5096	rundll32.exe	91
PID 5096 wrote to memory of 4848	5096	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc109dad7efe49b51c5360b6bdfb46fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc109dad7efe49b51c5360b6bdfb46fc.dll,#1
  2⤵
  PID:4848