3eb14a47eb63ec769510d15cb7facede9bca79a35d402f8d47f5bc6b3c69f2ce

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 19:04

Target

013065aef9d4e633f6ca4b34e091223e.dll
Size

24KB
MD5

013065aef9d4e633f6ca4b34e091223e
SHA1

0f5ee93334e9d64465ec20de32786482f5a0b64a
SHA256

3eb14a47eb63ec769510d15cb7facede9bca79a35d402f8d47f5bc6b3c69f2ce
SHA512

befe2e41834f99822dccadb30578cc04b4999fff059af0e08bbbbb314cd42b2e97f8f2d3de8715493912e105395a6d583a5d744a39e41d015038bb16684f0ddf
SSDEEP

384:oBJvOLBhi59aaFfcBgSuBBQARQk2hhICqmeVCML:+JmLBhM9a6cBIBBQARQkgICJW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3224	2348	rundll32.exe	42
PID 2348 wrote to memory of 3224	2348	rundll32.exe	42
PID 2348 wrote to memory of 3224	2348	rundll32.exe	42

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\013065aef9d4e633f6ca4b34e091223e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\013065aef9d4e633f6ca4b34e091223e.dll,#1
  2⤵
  PID:3224