4ee269301c2f5c25966ce616439dd9026bf6a13f6c40d040aa1637a13d8867d7

Analysis

max time kernel
158s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:51

Target

0c2f577e795404e6d397ae6a82bdb6b5.dll
Size

15KB
MD5

0c2f577e795404e6d397ae6a82bdb6b5
SHA1

58e62fcac86fc382d7674191bfdfbd1fbc773802
SHA256

4ee269301c2f5c25966ce616439dd9026bf6a13f6c40d040aa1637a13d8867d7
SHA512

c3b26084e4c80b8988c1536877d16d495294321e311b0c69c58c4550652ddc6eae7c247081e6cef482a6e68e4c1a9cd2a0c5158b91d07a68ea090d6bcef01b45
SSDEEP

192:/y8MYKUVh2MgjaX7JLUBCoRFbMIWcvmGI6iOIWcBY7DHCR3aIWiQBZHkxi:a/5WMaZUFfWCxQWQzR3tWxhF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4364	4972	rundll32.exe	90
PID 4972 wrote to memory of 4364	4972	rundll32.exe	90
PID 4972 wrote to memory of 4364	4972	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c2f577e795404e6d397ae6a82bdb6b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c2f577e795404e6d397ae6a82bdb6b5.dll,#1
  2⤵
  PID:4364