0229fca91b47f5a74265bd2fd058052a991da76cd70d920986726557e7cb760e

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 03:07

Target

0c8003b16a022e1def50e2f10143c9b2.dll
Size

708KB
MD5

0c8003b16a022e1def50e2f10143c9b2
SHA1

c00ab49c8ee0614ff5e8e8e5d5e65ad50f418703
SHA256

0229fca91b47f5a74265bd2fd058052a991da76cd70d920986726557e7cb760e
SHA512

b89bfec242dade3d9cb6ff303edbdaae33106e39c8bde75b1426fc3a6f44d1a160d88e4389078c801b4d3b3dbc8d71435666281c980e6a3124cce31016581edb
SSDEEP

12288:L8D4rWWkA/0ZNDROaIzR3JG4rD+Mti9/nXMcqxkBlgCNHqU2LNUPFyYyz0hbBUHg:ADuS5ZNdOaMZnPE9PXMcmklgCmcFgibH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1096	5060	rundll32.exe	27
PID 5060 wrote to memory of 1096	5060	rundll32.exe	27
PID 5060 wrote to memory of 1096	5060	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c8003b16a022e1def50e2f10143c9b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c8003b16a022e1def50e2f10143c9b2.dll,#1
  2⤵
  PID:1096

memory/1096-0-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download