f7ca81be537ddf4880b7fc0d2926b958204c1f55636b4638aaaaf2ef6f4b9b6a

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:12

Target

2ce84a0c122fd21fbe85bfe1fa6bb2ae.dll
Size

19KB
MD5

2ce84a0c122fd21fbe85bfe1fa6bb2ae
SHA1

424fa1265e94c3cbb19a03f9c3f0cadf80acca6c
SHA256

f7ca81be537ddf4880b7fc0d2926b958204c1f55636b4638aaaaf2ef6f4b9b6a
SHA512

e42335044ac1aeaba10ee0d8697de5194fad91bfff6b267862dc74ce262d8d1f91b91e2214646fb1d63b2da9414d5bde6703010b027ef2b4b2d1f6952a28ea67
SSDEEP

384:Psb5Vmd3vXGG+4F4SsT+qYQPrAa0I5hRJwyj+j8UXV1uU93R3NKD0Mou0or+/0R3:qXjc1bOF70PUMAXGejp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4712	4532	rundll32.exe	16
PID 4532 wrote to memory of 4712	4532	rundll32.exe	16
PID 4532 wrote to memory of 4712	4532	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ce84a0c122fd21fbe85bfe1fa6bb2ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ce84a0c122fd21fbe85bfe1fa6bb2ae.dll,#1
  2⤵
  PID:4712

memory/4712-0-0x0000000010000000-0x000000001006D000-memory.dmp

Filesize
436KB

Download