70d4d0abdcad10b6d4cdc6f6fec68322d5cf4219bb09454fa7bd40f6e2d1c6a5

Analysis

max time kernel
168s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:51

Target

07947709cd9eabe4d5ccdd4003aeb2cf.dll
Size

539KB
MD5

07947709cd9eabe4d5ccdd4003aeb2cf
SHA1

999f705adf8fff81ac3dec2caed5d224fad56b76
SHA256

70d4d0abdcad10b6d4cdc6f6fec68322d5cf4219bb09454fa7bd40f6e2d1c6a5
SHA512

f6571e785903a651242d20321756ba67531ed509602138bf410d4225dd1db6e0b9b4fdfa0ae38dab9359cc64008327fa229470c52878ca7ac077923543dbc7a1
SSDEEP

12288:bvoY0bqHq1FlTmQK6x08lhFL3/gwA7d1ZQsmiDSUkoTjP:bN0eq1FlN1xlPVc1ZQBQkoTjP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3048	4588	rundll32.exe	30
PID 4588 wrote to memory of 3048	4588	rundll32.exe	30
PID 4588 wrote to memory of 3048	4588	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07947709cd9eabe4d5ccdd4003aeb2cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07947709cd9eabe4d5ccdd4003aeb2cf.dll,#1
  2⤵
  PID:3048

memory/3048-0-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download
memory/3048-1-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download