6a3bfb081a9ebec9da2b303e17d22daa9ab2ea6690391f1c6f6c0ed73c11076b

Analysis

max time kernel
130s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 05:02

Target

0f715f9df4161ef41c45bcf7ecad93a6.dll
Size

22KB
MD5

0f715f9df4161ef41c45bcf7ecad93a6
SHA1

e14b1b0ed03ebbc896b3969250b464b56aa1bf8b
SHA256

6a3bfb081a9ebec9da2b303e17d22daa9ab2ea6690391f1c6f6c0ed73c11076b
SHA512

a8ead1f16d93a109b96f5799a384b2148350a36988f924953bec0c098a84b3cbc613c0e548f853ac5c2434966a277a9d77a843a71500cb5dc9524a49cc0e4d3f
SSDEEP

384:usYBrTnRiQU7yrH7M1OiRb4PAVMBIZIEwuiyNqD/:nYdTRiQUWrH7URbY0MyZIEwuby/

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4004	1712	rundll32.exe	14
PID 1712 wrote to memory of 4004	1712	rundll32.exe	14
PID 1712 wrote to memory of 4004	1712	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f715f9df4161ef41c45bcf7ecad93a6.dll,#1
1⤵
PID:4004

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f715f9df4161ef41c45bcf7ecad93a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712