e0790998a416adf8f8ec8b449653efd29a95f2523ca26090502320db578bb152

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:03

Target

05194ea1588dce61bd17e7966b893cdc.dll
Size

92KB
MD5

05194ea1588dce61bd17e7966b893cdc
SHA1

61284728cf1daa5104f8d86579a8c2ed47a41f50
SHA256

e0790998a416adf8f8ec8b449653efd29a95f2523ca26090502320db578bb152
SHA512

21499d895bdc590735154f6b8f956bd82cbd8b48726104c332f875035f4a9dc1955c2ff9af89cb6ad79bdcaadceea1d95d626c308cad3d3eb3041d4f050c35b8
SSDEEP

1536:g0VpmcgOoIp2O+cuI/d0o0iEXQAP44DSmdGr/iazoioY19Wap:HVpOZUUqd0o0nA4DCzoG1v

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3108	3840	rundll32.exe	87
PID 3840 wrote to memory of 3108	3840	rundll32.exe	87
PID 3840 wrote to memory of 3108	3840	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05194ea1588dce61bd17e7966b893cdc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05194ea1588dce61bd17e7966b893cdc.dll,#1
  2⤵
  PID:3108

memory/3108-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download