cb23c22c8bc83e97d024faa7b2b1461d67af9576b09db564dddf191057989372

Analysis

max time kernel
182s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:32

Target

1601ea77cf590827d2c9fe802d18b1e4.dll
Size

336KB
MD5

1601ea77cf590827d2c9fe802d18b1e4
SHA1

15314ce6a6944fd0de95f2bf529fa243cf23d533
SHA256

cb23c22c8bc83e97d024faa7b2b1461d67af9576b09db564dddf191057989372
SHA512

47edf1b991964c2a82161b2b397fdcd8f1c30cf2232969bcb46c0adc6100bda3f2158726a7e75f9bdea1de61a3eb19014f29f7d83a3e6a37ad520e67bf850ea8
SSDEEP

3072:Y12LibGjEy42Cb1pM4YLCvk82Fda2hGSYU8mbamddnDLu2OoifriKuECppmFU+P:a2OsbQppiX41uTRJKunmOFWZ8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4368	1124	rundll32.exe	87
PID 1124 wrote to memory of 4368	1124	rundll32.exe	87
PID 1124 wrote to memory of 4368	1124	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1601ea77cf590827d2c9fe802d18b1e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1601ea77cf590827d2c9fe802d18b1e4.dll,#1
  2⤵
  PID:4368