12ee0abaff4148c34f1127cf6885dd6f2ba78c2d99915edd1a7e6793de5b4d94

Analysis

max time kernel
151s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:48

Target

13b500fa529c13724375f12860881588.dll
Size

11KB
MD5

13b500fa529c13724375f12860881588
SHA1

4bfc87457fc5a7206aa925f560a41f8ece764035
SHA256

12ee0abaff4148c34f1127cf6885dd6f2ba78c2d99915edd1a7e6793de5b4d94
SHA512

ca4061af1c1a6a6e31825ae7c3ea19b3fd6257b58451f0b07ba866b760c293b14338e6825cd754f87c5f2cff9464081b102c1c0fa8207925bd117ed7159fce49
SSDEEP

192:mPoW/WyrTX4EGOue2EG1HixdmFvBDvdyexDwxWZmEc:mPoW/WoT7GOue2EkCxdmFvXbyxWVc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3748	1608	rundll32.exe	89
PID 1608 wrote to memory of 3748	1608	rundll32.exe	89
PID 1608 wrote to memory of 3748	1608	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13b500fa529c13724375f12860881588.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13b500fa529c13724375f12860881588.dll,#1
  2⤵
  PID:3748

memory/3748-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/3748-1-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download