09dfa9885a4c06593833c8d6d9bb3cf0b0ce2bc1480be34e13ecae1131a3008c

Analysis

max time kernel
174s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 22:02

Target

051347a3fce8ca42a245e3381d88ed97.dll
Size

598KB
MD5

051347a3fce8ca42a245e3381d88ed97
SHA1

5054828ad9cc03cd8b4e734972773489982f10a6
SHA256

09dfa9885a4c06593833c8d6d9bb3cf0b0ce2bc1480be34e13ecae1131a3008c
SHA512

4979adce33e3d71d75040f9dfa4c0f016163d3085261b0d23ac8627f522679435cd907769de451a535d3d3a5a84a492919370fcdd6f6ed29ab75a7ae6c8c263f
SSDEEP

12288:4qV2H/Y7ChDaO6NMSSgE7Y/Tt3GHsppuoqjvtNXtNktYa1oe2p3v:4P/Y7CA3E4tWHsirtNXvktY+Za

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 5100	3888	rundll32.exe	23
PID 3888 wrote to memory of 5100	3888	rundll32.exe	23
PID 3888 wrote to memory of 5100	3888	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\051347a3fce8ca42a245e3381d88ed97.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\051347a3fce8ca42a245e3381d88ed97.dll,#1
  2⤵
  PID:5100

memory/5100-0-0x0000000020000000-0x000000002000C000-memory.dmp

Filesize
48KB

Download