c19a8a1295c41a8b40f03e2eed20d1431cc6d796ee6848c2ae3d3f7e3bed5de3

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:37

Target

0be1e32a79732a9fbe928973e08ab528.dll
Size

29KB
MD5

0be1e32a79732a9fbe928973e08ab528
SHA1

2198b711e6efd2837b0d7ccbee4754cbdb204f7c
SHA256

c19a8a1295c41a8b40f03e2eed20d1431cc6d796ee6848c2ae3d3f7e3bed5de3
SHA512

10c9cfbbf3ffb8973e916e0ec9b2d6063e54087d201b9a212f525a61005d2919d86a5ed8573d471b7dd3a1bbb8c5a28e6678f5f20c6a0e093b372e7f60e5a42c
SSDEEP

384:5yuzmk3ySFy81TvV5Olz9HkGlY8Mb1Lc+oYr40fV/nScF1L1zs1zb101n1dBAAzT:HM81TvV5EhkWYQSBfv3L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 4984	1920	rundll32.exe	32
PID 1920 wrote to memory of 4984	1920	rundll32.exe	32
PID 1920 wrote to memory of 4984	1920	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be1e32a79732a9fbe928973e08ab528.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be1e32a79732a9fbe928973e08ab528.dll,#1
  2⤵
  PID:4984