b6e19d935305352319fd04df5a07b6435db5add16b57a05b30542adac748b771

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:25

Target

01a5fd2eed9da7919298afb3485b6057.dll
Size

292KB
MD5

01a5fd2eed9da7919298afb3485b6057
SHA1

6feb3a307574d679063d4e2d23e3affd4e59663d
SHA256

b6e19d935305352319fd04df5a07b6435db5add16b57a05b30542adac748b771
SHA512

62eaaeb0c3d0fac879f0664ed41d383c191e46e5bd4e07fc0ce371400de4080123706ca53797b2009aaf2f08adbe7b086ef04b052aa1df896fdaa39647ab011d
SSDEEP

6144:U7R6RaJfETkuMTEtqQBlI8qNKOppF2NgXsv13w+WW0XjCX0JoJWl4s:U7R64LCkQBl9qTFHstA+T0zCX0JoJ04s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 1596	3188	rundll32.exe	71
PID 3188 wrote to memory of 1596	3188	rundll32.exe	71
PID 3188 wrote to memory of 1596	3188	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a5fd2eed9da7919298afb3485b6057.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a5fd2eed9da7919298afb3485b6057.dll,#1
  2⤵
  PID:1596

memory/1596-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1596-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1596-2-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download