35b8c503034a4dc28627a8df60f920d5cbdc5d6d030b1ffb645effc31b2f8aa1

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:06

Target
0ddd2e98687f832682a8a7fb7af09f0d.dll
Size 7KB
Sample231230-en2znscbc6
SHA256 35b8c503034a4dc28627a8df60f920d5cbdc5d6d030b1ffb645effc31b2f8aa1
MD5 0ddd2e98687f832682a8a7fb7af09f0d
SHA1 5df33454af0694b2db9148179d5394dc22233a5e
SHA512 f81067a9d618afd3a01987361c97cb6fdeb5b38f0721e0b9fab8acc0531a5a1f854ead4ac2ccb90919578fbb939696292d9bb5c838fc2471bd9c1512dc30d46e
SSDEEP 96:NGI+n9rOdqUTo6zJBp8Q7/+a67OXCxeQPRIq:V+lOvNl67OXsecK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2556	5092	rundll32.exe	15
PID 5092 wrote to memory of 2556	5092	rundll32.exe	15
PID 5092 wrote to memory of 2556	5092	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ddd2e98687f832682a8a7fb7af09f0d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ddd2e98687f832682a8a7fb7af09f0d.dll,#1
  2⤵
  PID:2556