d3aab66f1b3bc604042337e29a52aec4bb742a91e508a519382c1fb84b7eb1a7

Analysis

max time kernel
149s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:49

Target

fde6f70a49c6968d5b316bdd26f0a4e0.dll
Size

475KB
MD5

fde6f70a49c6968d5b316bdd26f0a4e0
SHA1

4b1f7d2eb930b2eebbd0ad149ebb8d138a1d747e
SHA256

d3aab66f1b3bc604042337e29a52aec4bb742a91e508a519382c1fb84b7eb1a7
SHA512

0863ca5aac57c503681afcbef1d932bfaaf7bc1fb3403fc444a93247c2f2acb4c5aedcc51352e9ce732a84ca04f9ce7996c67a2b0594aa17db7e930eb23a52d2
SSDEEP

6144:2KUbbBKkfUaT+7CwuLWQA2QFhTEqxxkNuaa/w2SOrpTbZi9MFvUku0PpNg:EbbkksaToMA9hTEy4uamFTbOUv5P7g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4960	4780	rundll32.exe	16
PID 4780 wrote to memory of 4960	4780	rundll32.exe	16
PID 4780 wrote to memory of 4960	4780	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fde6f70a49c6968d5b316bdd26f0a4e0.dll,#1
1⤵
PID:4960

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fde6f70a49c6968d5b316bdd26f0a4e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780

memory/4960-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download