d61bd3378baf0d3ad310d6aac861baec3c1cde59d15dd5174e46d451abbfa18a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 06:30

Target

2bc17a158cfc9bf7ab71517818f73dea.dll
Size

126KB
MD5

2bc17a158cfc9bf7ab71517818f73dea
SHA1

a85f4b9ba7493c75db4e6617d25a44fa9d9086b7
SHA256

d61bd3378baf0d3ad310d6aac861baec3c1cde59d15dd5174e46d451abbfa18a
SHA512

ce5321dfe1c62c0f5fad74cef2df26291621f3cc97fe5e538d9b2877318ac99e31bfacb6968bf94343f1296f324437226dabd186429a038ebcf63ddb5a5ccf9d
SSDEEP

1536:50dGw8Zc9MP6+fKd09jtLGb+kHqs7ouggNkTQiNUHT7Bf:50dGN6+fKd0h5Gb2iou7NkUKcBf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3860	1652	rundll32.exe	16
PID 1652 wrote to memory of 3860	1652	rundll32.exe	16
PID 1652 wrote to memory of 3860	1652	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc17a158cfc9bf7ab71517818f73dea.dll,#1
1⤵
PID:3860

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc17a158cfc9bf7ab71517818f73dea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

memory/3860-0-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download