75b55921f066f0cf477e826eba7dd9c61bc28d248fa0115ce05dcab78cb72a90

Analysis

max time kernel
151s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:21

Target

0454d67a1775a93ec838434857c2bf79.dll
Size

32KB
MD5

0454d67a1775a93ec838434857c2bf79
SHA1

6e4095c56822b51c41454c5b0662ecd19f592f58
SHA256

75b55921f066f0cf477e826eba7dd9c61bc28d248fa0115ce05dcab78cb72a90
SHA512

8a63111468bd5a9a62718f441f05d696ee1951b9a2347eced1411cd8476fb86aed3c11d8c0280b98884ab1de0d997ca8684700b40a755114a8a472e62d3392a4
SSDEEP

768:DbQqCiZHgb+X6glv+CrCgmUSacGo3VBffd6722MDylb0OqOSBRBaM:DbhCiZAW6glv+CrCgmUSacGo3VBfQ72j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 2116	4424	rundll32.exe	90
PID 4424 wrote to memory of 2116	4424	rundll32.exe	90
PID 4424 wrote to memory of 2116	4424	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0454d67a1775a93ec838434857c2bf79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0454d67a1775a93ec838434857c2bf79.dll,#1
  2⤵
  PID:2116