2450a5c9e7fb9c6f9eef18626a407e20ea5180470c21700f47e9da730342eabb

Analysis

max time kernel
110s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:15

Target

242bf7fe218c3d2107f38472c988953b.dll
Size

2.5MB
MD5

242bf7fe218c3d2107f38472c988953b
SHA1

88af32b79c5c93db117a7aaa5062f72f64f10015
SHA256

2450a5c9e7fb9c6f9eef18626a407e20ea5180470c21700f47e9da730342eabb
SHA512

f058a2a978df32ef12d4e4d0565a2d55d4e5de62a2fc2b7ff0546025cf40bb5a5b9f71eb3d561c537d14a3c85196e00bc12271099526682dbf1bd0d70a50f7c2
SSDEEP

49152:AVk6y3tQu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q5HkL+eUYWHsiJNXi:A26y3SWGoqZ92yVG/uzGNV9HkAVHL/S

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1012	1664	rundll32.exe	17
PID 1664 wrote to memory of 1012	1664	rundll32.exe	17
PID 1664 wrote to memory of 1012	1664	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\242bf7fe218c3d2107f38472c988953b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\242bf7fe218c3d2107f38472c988953b.dll,#1
  2⤵
  PID:1012

memory/1012-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download