05b260e8dc73d02abfff2a3b9d04f7375a9fec58ec613ab44498d93be621c6ec

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 05:31

Target

2a1729a3184d4e775c3812ed92523c01.dll
Size

840KB
MD5

2a1729a3184d4e775c3812ed92523c01
SHA1

a6fdb9037dd2998675d55ab83b9e1e172037e3d4
SHA256

05b260e8dc73d02abfff2a3b9d04f7375a9fec58ec613ab44498d93be621c6ec
SHA512

141d62491673c8d70bf40e9ddbc3b2bd9e5b7f11465420d5815bd4b6c37a52711d6dfd3cc7df0f8d2a786ea260145d79067c8a17070dd1210d6750a216b0adbe
SSDEEP

12288:XAPrZR6lm8Ed6rvf66QKq5QgWHhlO4IdeMoaFBZEO2IRwuXUrUtRsVy9:XAtIm8EMrvf66/q2goONFJ2QwuXUrBC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3084	4224	rundll32.exe	16
PID 4224 wrote to memory of 3084	4224	rundll32.exe	16
PID 4224 wrote to memory of 3084	4224	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a1729a3184d4e775c3812ed92523c01.dll,#1
1⤵
PID:3084

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a1729a3184d4e775c3812ed92523c01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4224