d426f89a621ea83110b13e5a4253fcd7330cf2a0e7ba10433f5a84b028c5c2dc

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:18

Target

0b695d07546be0a0b09fe1e4b0b1309b.dll
Size

28KB
MD5

0b695d07546be0a0b09fe1e4b0b1309b
SHA1

f0e61e793ec1d1e46544f666a2819f9192b1d8c2
SHA256

d426f89a621ea83110b13e5a4253fcd7330cf2a0e7ba10433f5a84b028c5c2dc
SHA512

da74aa2e79ba72cfb398fdd3a8144fc0970dd7f005afa7aad4d929e7d7a011d76b47e18a926f1684d28f8e4d6459a432f862bd67d190a96b8bdaa630447257d7
SSDEEP

384:8tyuzCkzySFy8BTTVhOFf9nQWAOAYoEMOcbKwmIHLdcANQkHflaIm1Azlu8wl:MM8BTTVhgJQSoEtcLvNj4INlu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1824	2968	rundll32.exe	64
PID 2968 wrote to memory of 1824	2968	rundll32.exe	64
PID 2968 wrote to memory of 1824	2968	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b695d07546be0a0b09fe1e4b0b1309b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b695d07546be0a0b09fe1e4b0b1309b.dll,#1
  2⤵
  PID:1824

memory/1824-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1824-3-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1824-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1824-7-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1824-11-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download