c267f8f1b91b876a297bf62c51c74b7aea11c6b91f50a00482a976ad77328bae

Analysis

max time kernel
135s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:38

Target

00b40fa60bbc15367a174dc3239543ed.dll
Size

94KB
MD5

00b40fa60bbc15367a174dc3239543ed
SHA1

40adf987f8a14b26d2358bf585dcd178a9937bb3
SHA256

c267f8f1b91b876a297bf62c51c74b7aea11c6b91f50a00482a976ad77328bae
SHA512

86e47ca5bba0c22b561d8a0fbc7641382ff16a782f5a2859e2dd0ea8e581a669d0fcef5ba0c332b037582e2617499bf739589acae7c73f2ba5ef22ecb348790c
SSDEEP

1536:P+HQ3img2XPuAaEJMPxb1pLcP4zbydSrQojPD2LjWGLm:WHQFt/ogMPxb1VcAz8ojPD2LjWGLm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 1004	3520	rundll32.exe	90
PID 3520 wrote to memory of 1004	3520	rundll32.exe	90
PID 3520 wrote to memory of 1004	3520	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b40fa60bbc15367a174dc3239543ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b40fa60bbc15367a174dc3239543ed.dll,#1
  2⤵
  PID:1004

memory/1004-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download