f99fb4f487c9e15ebdcb1a5c617edea164f17c8ec2182c30a8709ba80528969c

Analysis

max time kernel
149s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 22:15

Target

0561fc6f14bf87812d19a72a74e15d06.dll
Size

16KB
MD5

0561fc6f14bf87812d19a72a74e15d06
SHA1

4bbd91f64f080d401a6f0a1d62404d29ec32a09b
SHA256

f99fb4f487c9e15ebdcb1a5c617edea164f17c8ec2182c30a8709ba80528969c
SHA512

795b282cbb2b03ffe64017b9860870de22c4562f4add2e0bba872331d3b2f1cbbcba77fe28428f343d45a94933a0f6e022b2cb3b4605f3495d1d475fc464c86e
SSDEEP

192:yqZ5k6hX7tdA2gpR1268iglgIsouurI5j9T2uoU8vNccbT5MIpH8GfiK4H:XZ5LrAfp3gigWIDuuUsFRMA8GSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1232	3696	rundll32.exe	14
PID 3696 wrote to memory of 1232	3696	rundll32.exe	14
PID 3696 wrote to memory of 1232	3696	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0561fc6f14bf87812d19a72a74e15d06.dll,#1
1⤵
PID:1232

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0561fc6f14bf87812d19a72a74e15d06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3696

memory/1232-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download