52865a13478833260b109e81900bf60e8ff1439366d5c1d58c9a067578f0252a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:19

Target

0b705624fc7a40ff87fedc745ba564e4.dll
Size

291KB
MD5

0b705624fc7a40ff87fedc745ba564e4
SHA1

fcf4dd9a872ff3a3db5c676b4b08e281937cc3a5
SHA256

52865a13478833260b109e81900bf60e8ff1439366d5c1d58c9a067578f0252a
SHA512

1fcd0a8378cae8372af61386bf4eabd9d51e4e656865ea0c28846093fd1c6953dc072e1047d7e9c0b16b34b6c82e9b00801c279483dbe179aaa8f946b0b1908c
SSDEEP

6144:GGskUJ78Cwr9AjmwEF9yaF5urX6VEw1Cj8QRakIDsW6hB:GGF88pitEeG5YX6aXBRak0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1932	2612	rundll32.exe	16
PID 2612 wrote to memory of 1932	2612	rundll32.exe	16
PID 2612 wrote to memory of 1932	2612	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b705624fc7a40ff87fedc745ba564e4.dll,#1
1⤵
PID:1932

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b705624fc7a40ff87fedc745ba564e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612

memory/1932-0-0x0000000013140000-0x0000000013247000-memory.dmp

Filesize
1.0MB

Download