1d3de5c1d0678a4adb1f5be5fb8eb58d1d3c5d128959603b033b98019c61edef

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:35

Target

05c68ba3928537074e96a74add934dd7.dll
Size

26KB
MD5

05c68ba3928537074e96a74add934dd7
SHA1

0e011c9cd32ca2e6605466502a24b2c26d584d18
SHA256

1d3de5c1d0678a4adb1f5be5fb8eb58d1d3c5d128959603b033b98019c61edef
SHA512

e73ee9b6935c8b2fbc38b2599758794a9a4e2ccb775572153f4108727b351861abde39f6d64a80434bb2cde3089afe12d0931d2e6de4e8fe19226ac9ceca6395
SSDEEP

384:ilVEmJMkEjYh2sgOF8LllzMpCKxiD03aGT5DZ2FKLiqB+WD6WKrRN8NVwk4Nf:wVnukEXsRF8ZEiD03aurLj+WD6RRNw8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2856	3708	rundll32.exe	14
PID 3708 wrote to memory of 2856	3708	rundll32.exe	14
PID 3708 wrote to memory of 2856	3708	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05c68ba3928537074e96a74add934dd7.dll,#1
1⤵
PID:2856

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05c68ba3928537074e96a74add934dd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708