17b804e74add38941e154d67481907433c51b92e14decf4cf68e1c4052c6e91c

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 00:42

Target

221aacab50811d6b3aa3437980bd67e6.dll
Size

208KB
MD5

221aacab50811d6b3aa3437980bd67e6
SHA1

a9bd404f576d7bf8911ce6c067c16819d355e2d7
SHA256

17b804e74add38941e154d67481907433c51b92e14decf4cf68e1c4052c6e91c
SHA512

d1940ecf0a0abd0ea3ba8f6b1fb209a19f5762ca96bedaadeb1f1f22a3ff2bfb53319ebeb7b978361421c63eedabd568d3cf15f3ec106de76225d25ed96aff04
SSDEEP

3072:IRDonnJTeXlRwc6619ib2SQgkzW5SsGAvNmft6sKiTgHzv/Q1B2Vyg27WQmo+C+a:YUnnJTeXQcl9i/kzWrGQNImD8nxMM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1420	1400	rundll32.exe	16
PID 1400 wrote to memory of 1420	1400	rundll32.exe	16
PID 1400 wrote to memory of 1420	1400	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221aacab50811d6b3aa3437980bd67e6.dll,#1
1⤵
PID:1420

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221aacab50811d6b3aa3437980bd67e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

memory/1420-3-0x0000000000D90000-0x0000000000D9E000-memory.dmp

Filesize
56KB

Download
memory/1420-2-0x0000000000D80000-0x0000000000D8F000-memory.dmp

Filesize
60KB

Download
memory/1420-1-0x0000000075020000-0x0000000075056000-memory.dmp

Filesize
216KB

Download
memory/1420-0-0x0000000000D90000-0x0000000000D9E000-memory.dmp

Filesize
56KB

Download