8c70c9c6060cc4eb98470705bc193e66f49c41f806eb1a38afdf3b7b12abea14

Analysis

max time kernel
131s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:07

Target

1dfedcf2c37631739599fcc736e4572d.dll
Size

16KB
MD5

1dfedcf2c37631739599fcc736e4572d
SHA1

fe6f235f670f2da161056ff4dc50a1b0585430aa
SHA256

8c70c9c6060cc4eb98470705bc193e66f49c41f806eb1a38afdf3b7b12abea14
SHA512

64162f9ddb84d56bd02c7a392169764f357524f9d4ab4c85b0fcaa1758c49d20dfa9026aa091e53bf0a7d42d42d73efdd6d25f9e91dd33c3749ac3b64cd24e88
SSDEEP

192:Pp4DCs7GuWS50ZNOp6XKPjI+idSDbFiWF3uBBQ6PRQk/2Wrexh4/P:haCvuWSGfpxwJuBBQARQkhrexa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1800	1508	rundll32.exe	14
PID 1508 wrote to memory of 1800	1508	rundll32.exe	14
PID 1508 wrote to memory of 1800	1508	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfedcf2c37631739599fcc736e4572d.dll,#1
1⤵
PID:1800

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfedcf2c37631739599fcc736e4572d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508