d42eef6623212581641f9f44da3084e355a4a36758011d0194c22aa7d3204192

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:26

Target

0e6abde701b4b52b763f1d3c749f10ad.dll
Size

27KB
MD5

0e6abde701b4b52b763f1d3c749f10ad
SHA1

c8cce3e89787d6eb1f2531d0bb830d1b4e241659
SHA256

d42eef6623212581641f9f44da3084e355a4a36758011d0194c22aa7d3204192
SHA512

e1905f8bbd78ec0925a67dae8181f8f4a48d5790a001ed8ad70436146695d6b61f96024cf337aa12bc573c9399cb3bd5d26bd98441e2b45c4f78583252f588b3
SSDEEP

384:R5yuzmk3ySFy81TvV5OlP9HkGlY8MEuMP4CgLUpT2zZ1RtD171jt18g1f1aIRRGF:FM81TvV5ghkWYbMP4PZ1bgDsK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3352	4940	rundll32.exe	87
PID 4940 wrote to memory of 3352	4940	rundll32.exe	87
PID 4940 wrote to memory of 3352	4940	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e6abde701b4b52b763f1d3c749f10ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e6abde701b4b52b763f1d3c749f10ad.dll,#1
  2⤵
  PID:3352