3a224f2c3239347ae764c18feb578b47e2d2a42840d095b95ef931a8960a1f4e

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 00:34

Target

21ddb4e09e32c81b34ec119cc1713160.dll
Size

73KB
MD5

21ddb4e09e32c81b34ec119cc1713160
SHA1

cf4d79d142118db282e915bba07dc44b7063a698
SHA256

3a224f2c3239347ae764c18feb578b47e2d2a42840d095b95ef931a8960a1f4e
SHA512

e8cad04d00d2c83516319baefdb7f28253e00b98e06c1fa9661c83ca4179a56545580d937f3cd2718d7dd7fec2d8ce9512b06eed69a1219fefcf1de07ce8e042
SSDEEP

1536:UGnD7SErvH635tE01Ri5HqcBMpBP0JEWcWMXu6WC15xqnan5:bDva/EGRi5w0JEWdMP7jCs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2760	4048	rundll32.exe	86
PID 4048 wrote to memory of 2760	4048	rundll32.exe	86
PID 4048 wrote to memory of 2760	4048	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21ddb4e09e32c81b34ec119cc1713160.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21ddb4e09e32c81b34ec119cc1713160.dll,#1
  2⤵
  PID:2760