609c3be8b6bfd7b0e985d5fd0fadcfbb75fd5438826ee54f333377282b76e496

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:57

Target

0c4cac0eb80a1cc7d0ae902807bdc71d.dll
Size

21KB
MD5

0c4cac0eb80a1cc7d0ae902807bdc71d
SHA1

10979bf2a63c9243af4483b5bddb7d2fcce712e8
SHA256

609c3be8b6bfd7b0e985d5fd0fadcfbb75fd5438826ee54f333377282b76e496
SHA512

71cf1bb57f9285744d2055b7560aea461a3782e36ff41d00147c729f899383c19b872ffe78713f8f9fe98bf7b5e9b07e88eed4521173025b9f0f7775da624455
SSDEEP

384:nbQPWzOEq+yiVtI89AP1DtxH4bfUwG6581fqWcw883MpWBzcVz:nbDI8CBbH44w5581fqWcwny

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3480	2120	rundll32.exe	14
PID 2120 wrote to memory of 3480	2120	rundll32.exe	14
PID 2120 wrote to memory of 3480	2120	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c4cac0eb80a1cc7d0ae902807bdc71d.dll,#1
1⤵
PID:3480

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c4cac0eb80a1cc7d0ae902807bdc71d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120

memory/3480-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download