2aed43b23e9e778a28834e06811d0ed6cb128459bb0f9be5601dc8ee2ac8440d

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:18

Target

261902346e2b613a5f9b8576ba9465c0.dll
Size

23KB
MD5

261902346e2b613a5f9b8576ba9465c0
SHA1

cc9860f8704f0869e1e41226d76dc0b38834150c
SHA256

2aed43b23e9e778a28834e06811d0ed6cb128459bb0f9be5601dc8ee2ac8440d
SHA512

75615177086b4b5be1d854be43907f1dae19efb03c212c41cd6912fff2300d5d5c11e4a57212411d8e765e840ee5cbbe61a7883afaa84aa11d1d2bef5d6e64e5
SSDEEP

384:O/dxz0CHshqd+15LQ+RtD8B6M8TdxF1B8ijsHT93YO4OlAzU16LS9X/:OkCHEqdSZQmhI6MsxF19sHTF4OiU1A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1320	1672	rundll32.exe	14
PID 1672 wrote to memory of 1320	1672	rundll32.exe	14
PID 1672 wrote to memory of 1320	1672	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\261902346e2b613a5f9b8576ba9465c0.dll,#1
1⤵
PID:1320

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\261902346e2b613a5f9b8576ba9465c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

memory/1320-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download