6343cf3cf80249b6040787f31f2c2d9ed6acbcf13d4cbcd73c2fbfc67a7aff61

Analysis

max time kernel
163s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 23:43

Target

206ca8cb0deb21264e6830e91c458ee1.dll
Size

60KB
MD5

206ca8cb0deb21264e6830e91c458ee1
SHA1

d61a60d6e5db1eab89afc525cf57df6b644a91db
SHA256

6343cf3cf80249b6040787f31f2c2d9ed6acbcf13d4cbcd73c2fbfc67a7aff61
SHA512

0017ac123fb84f63aab12b695150ed0e9dbea70dcd77ed6dbad2ceaad3693d066b42ecfabd741cf12686277025ef58e5077e5a6e7f2f22529c78ca277250f38a
SSDEEP

768:sZzEo8fwrovycHQJ3dVj/ElTyBDXo9a5Ja0I8n2vjeK96eRqqU7uw:sRE5f8ovpe3dVj/IO5oIJ/iues37J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3240	2252	rundll32.exe	90
PID 2252 wrote to memory of 3240	2252	rundll32.exe	90
PID 2252 wrote to memory of 3240	2252	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\206ca8cb0deb21264e6830e91c458ee1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\206ca8cb0deb21264e6830e91c458ee1.dll,#1
  2⤵
  PID:3240

memory/3240-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3240-1-0x0000000002DD0000-0x0000000002EA6000-memory.dmp

Filesize
856KB

Download
memory/3240-2-0x0000000002DD0000-0x0000000002EA6000-memory.dmp

Filesize
856KB

Download