e26af822848688637f0b434f70b6d58e736e25caca7a9bed9be94d85618da01c

Analysis

max time kernel
162s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 21:28

Target

f95af3f9addee29bb203256335fc318b.dll
Size

71KB
MD5

f95af3f9addee29bb203256335fc318b
SHA1

cd595ca70bb4938088350453f83e2f39c0876bc9
SHA256

e26af822848688637f0b434f70b6d58e736e25caca7a9bed9be94d85618da01c
SHA512

57c67d6d4a4c64c94bd38a8d13de297d2868d1f4798354bd0ab1789e1dd7dd6e6e128a863f9e3704b0e799ba0f5ce75db20385b923782efc37ed5cd032436d5c
SSDEEP

1536:AfeGBiRUWWjXVTVwKLRw1qKf6uwV19mlKG70S2qbU+chxzWYsly/UJ:kARUWWjXVTV/Fw1qKf6uw7wl/2qbU+cq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2920	1752	rundll32.exe	47
PID 1752 wrote to memory of 2920	1752	rundll32.exe	47
PID 1752 wrote to memory of 2920	1752	rundll32.exe	47

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f95af3f9addee29bb203256335fc318b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f95af3f9addee29bb203256335fc318b.dll,#1
  2⤵
  PID:2920

memory/2920-0-0x0000000000870000-0x00000000008D2000-memory.dmp

Filesize
392KB

Download