01ec974abd242dff19070e49105700e34fbae97c21759f7b09bb2b217a956643

Analysis

max time kernel
138s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:49

Target

06188decb95a1e5bc4105347abd95d80.dll
Size

35KB
MD5

06188decb95a1e5bc4105347abd95d80
SHA1

cfadff6809a09dce1d634a7ea9943245b7a4eea5
SHA256

01ec974abd242dff19070e49105700e34fbae97c21759f7b09bb2b217a956643
SHA512

b1ddee54aa473d37693a3fe71cd5de94eaf0919afdf227afb76bba0da5d86075ce30cd2ea3677bad6076d94d9b8b5b9a5eb438923fa427c6dfedbdf2cc5ab374
SSDEEP

768:DbWoNO4V2o6I4Iz1/ija+1IK9j8BhX0ALoUY+vRYOpBlMRTtPQFeBGRRuY:D9FWob2UY+vKOpBlGTZkak

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2944	rundll32.exe
2944	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2944	4272	rundll32.exe	16
PID 4272 wrote to memory of 2944	4272	rundll32.exe	16
PID 4272 wrote to memory of 2944	4272	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06188decb95a1e5bc4105347abd95d80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272