2e58ec1e6b23bbbe612258e4f5a7dd256860ffc2e603f32182a3ce82e53d7e64

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:51

Target

26fcf4fb4ca60845ff6cfd929d934b93.dll
Size

23KB
MD5

26fcf4fb4ca60845ff6cfd929d934b93
SHA1

7a42619534a1f21497b79987f9842de654092aaa
SHA256

2e58ec1e6b23bbbe612258e4f5a7dd256860ffc2e603f32182a3ce82e53d7e64
SHA512

5f6c1a5a6e7cabca3b7535c917618c39dfc3ba7e126e6835c1f123d4c23740c8c107c06be2d25245b7cf9be9389fcd2b4f264a1b8f1b4d041fbc9af8bb752e04
SSDEEP

384:DiF/TrG/ItgvQHeaqiyy1q4YheN/CxNhxtSrI2GVfleohYb25pZhqquL4BVe:DWW/HgNQ4YheNCRkWDhYa7Zh/Y4Pe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4484	4772	rundll32.exe	14
PID 4772 wrote to memory of 4484	4772	rundll32.exe	14
PID 4772 wrote to memory of 4484	4772	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26fcf4fb4ca60845ff6cfd929d934b93.dll,#1
1⤵
PID:4484

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26fcf4fb4ca60845ff6cfd929d934b93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772