48db9c7a58bd1e147616db1f3264f9be66b5889c1f84a050bf02133f54433209

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 20:59

Target

f7d392ed6a6254e1e243ad90e503d7ea.dll
Size

89KB
MD5

f7d392ed6a6254e1e243ad90e503d7ea
SHA1

27eb4593d04bd2359807e44c914adff921d5a112
SHA256

48db9c7a58bd1e147616db1f3264f9be66b5889c1f84a050bf02133f54433209
SHA512

5d8aad6761f9d5463804a049a4f6227ac1409e64f3020385b9fbe16d15544af2f0420f88e8effa83608e1dc58a912fc55e643b56835192f9458f5de3db0e40e8
SSDEEP

1536:KYD/szd1ptO2+sD0d2n8isKC1+zNoCkoCHOT9HJB0eAiV:tzszdM2hDo2n5sKC16oCkoCHOBHJBv

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1684	1772	rundll32.exe	12
PID 1772 wrote to memory of 1684	1772	rundll32.exe	12
PID 1772 wrote to memory of 1684	1772	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7d392ed6a6254e1e243ad90e503d7ea.dll,#1
1⤵
PID:1684

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7d392ed6a6254e1e243ad90e503d7ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772