a22a44a51120148f412a609156342d8e2f0116308ba7ef7a1481c8e52cae319c

Analysis

max time kernel
203s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 00:45

Target

pp.dll
Size

15.8MB
MD5

e275ab14b4fa93cf4a043dcfd658e91a
SHA1

7e877896c0cc34ad7b289666dab39ecaecf8baac
SHA256

cf7bbc219ac0812a493448daf43b502d5bf81d341e56ea8484bc82ba927afc72
SHA512

76bd30a6eb95a0d6b3bafb40c655d185d1ab650d66c174c58e5da5ca7721f85c288a4312a8f45a4c4f75ccc21a9a36daad1624a6be49ef6e821ecbc56bef7478
SSDEEP

49152:3Wap7JOaRRYSeUzFTf/3FlNsSaoQILMHcj6qq9re5GsTuTYA79LDCvguw+60GCdG:3HIaR5zNsSaoLj6D92slDCvguP6O9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4168 wrote to memory of 60	4168	rundll32.exe	rundll32.exe
PID 4168 wrote to memory of 60	4168	rundll32.exe	rundll32.exe
PID 4168 wrote to memory of 60	4168	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pp.dll,#1
2⤵
PID:60

memory/60-0-0x00000000025A0000-0x000000000357B000-memory.dmp

Filesize
15.9MB

Download