fdfd326cca8076771d4d259c8996031e9c85c403e20a0e49446d8a099351ddef

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:46

Target

022b65e3cbb4683ad9e5937c507dcf50.dll
Size

88KB
MD5

022b65e3cbb4683ad9e5937c507dcf50
SHA1

441fd33d69c9395cb269cd55c5a165789efa8ecb
SHA256

fdfd326cca8076771d4d259c8996031e9c85c403e20a0e49446d8a099351ddef
SHA512

6a2b7449e28c97d6a7100c82058003509fa52f3bc6f3699727701f88621742dc05241f6670c18fda7cdde5304cdd7beb33bf299fb8a0f5db6a142a0412ae3334
SSDEEP

1536:7tx2WTTtlK05v0eYQA2xZ9T6L448bZ0PMVruGGway0ioS:JoWTTq05XFAWZmJ810CJ0ioS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2108	1752	rundll32.exe	67
PID 1752 wrote to memory of 2108	1752	rundll32.exe	67
PID 1752 wrote to memory of 2108	1752	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\022b65e3cbb4683ad9e5937c507dcf50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\022b65e3cbb4683ad9e5937c507dcf50.dll,#1
  2⤵
  PID:2108