21131a46fa26c6005fb63680ace2779a277b31289f01bc0da3ef9c5aaa3884bd

Analysis

max time kernel
147s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:06

Target

196e46905b3212fbf48c267c352822bd.dll
Size

1.5MB
MD5

196e46905b3212fbf48c267c352822bd
SHA1

b9c0e522f3095657d072e927d54842979748b6e6
SHA256

21131a46fa26c6005fb63680ace2779a277b31289f01bc0da3ef9c5aaa3884bd
SHA512

1bf2d5b4be5160abe8c148f337b68942373cc4e0ceffaa7f2e1e6ca316dc3a947c9e793c2d180bb3d4bcbb7291ea14fbc802af0853bd7b412b44e61145ef9ba2
SSDEEP

24576:+RYOQBLFIpu+pS0+M3tb0pvaep5ZfCvillsQUfIKKuZAP2tgODWQMFuuJKY3P:LLFiu/0J3tCieD4vi/sQxKbdUQMFuu1P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4812	4920	rundll32.exe	16
PID 4920 wrote to memory of 4812	4920	rundll32.exe	16
PID 4920 wrote to memory of 4812	4920	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\196e46905b3212fbf48c267c352822bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\196e46905b3212fbf48c267c352822bd.dll,#1
  2⤵
  PID:4812