1a72a168d9a2d8998b6c8d8ab30757820b333cac6398dee5d8b8b5e12986936c

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:58

Target

0271cf787f55cf56177e35cdec32785d.dll
Size

24KB
MD5

0271cf787f55cf56177e35cdec32785d
SHA1

f10e7430690f0d93ba94b7dceef087e1ad64c881
SHA256

1a72a168d9a2d8998b6c8d8ab30757820b333cac6398dee5d8b8b5e12986936c
SHA512

1dcfbd71c065efcaec5a2eb7299274eabd20f15450106412c2738fcaba4542e38142d1fbe5c613808ca66e43e58e6bedf5f8d4bb2a1082fa7a1ff5f9bcf27309
SSDEEP

384:/aUxz0C+Mgqd+1pqBQe+VItZFfVwid1LEXQgPcP7WxgYmVMf2nUS7OAzQNTr:iRC+lqdSwBQhWDzwid1LZYcPg/R2lT2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1508	4588	rundll32.exe	89
PID 4588 wrote to memory of 1508	4588	rundll32.exe	89
PID 4588 wrote to memory of 1508	4588	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0271cf787f55cf56177e35cdec32785d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0271cf787f55cf56177e35cdec32785d.dll,#1
  2⤵
  PID:1508

memory/1508-0-0x0000000000630000-0x000000000063C000-memory.dmp

Filesize
48KB

Download