8db7b682aa2fbd39227a608cbadf6b8b317a44bf8660afcc4bc4c46f4f659042

Analysis

max time kernel
176s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:35

Target

0d218f86974a55b2b9e7ffe79e3f4bc3.dll
Size

184KB
MD5

0d218f86974a55b2b9e7ffe79e3f4bc3
SHA1

0be5d5b712995ada5fac8e9bc4cb2bda767759a7
SHA256

8db7b682aa2fbd39227a608cbadf6b8b317a44bf8660afcc4bc4c46f4f659042
SHA512

03f860af3922769b85a3a66c0def266473ae36890748f89609eb615f5146a9309525b41bc46a77b09cb33d69877e34440f838c63106154d3ccf7f4adddaa5e4a
SSDEEP

1536:VaIHIJkuvfZ/AuwZBy2xDoSLVYOzi32v+JAIRprTL4InjPn2HlNySsn4/StI9S5t:IkyxvfGZUSx3eSIRprQun4/kI97g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4144	3704	rundll32.exe	87
PID 3704 wrote to memory of 4144	3704	rundll32.exe	87
PID 3704 wrote to memory of 4144	3704	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d218f86974a55b2b9e7ffe79e3f4bc3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d218f86974a55b2b9e7ffe79e3f4bc3.dll,#1
  2⤵
  PID:4144

memory/4144-0-0x0000000010000000-0x0000000010034000-memory.dmp

Filesize
208KB

Download