45d61a8ee191bc48f9edaa2aff483b057d78d4f4b9b5b09f3235f990b5dadcca

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:51

Target

079371bfa4bd42eccc55634128e8e6a4.dll
Size

36KB
MD5

079371bfa4bd42eccc55634128e8e6a4
SHA1

a8ef98d01664ac879e5f3e5af3c0d467f0d0557c
SHA256

45d61a8ee191bc48f9edaa2aff483b057d78d4f4b9b5b09f3235f990b5dadcca
SHA512

06df78263bc8a84cf1febb07bdca75af9720218ecf0b07173ffd8ca2b5aaee517ecf0d69c3ec75c156ee0653952f1aa1838bdb2e0029a6c8aec2594b828f49a2
SSDEEP

768:M4ByKq2Q6NBn08gBIPgAKVvU4hVHYRl3T/JCjE9RCrkk6Ow:MdKq2Qc2PU+Q3bJ1Gd6L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2988	3712	rundll32.exe	16
PID 3712 wrote to memory of 2988	3712	rundll32.exe	16
PID 3712 wrote to memory of 2988	3712	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\079371bfa4bd42eccc55634128e8e6a4.dll,#1
1⤵
PID:2988

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\079371bfa4bd42eccc55634128e8e6a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3712