752379e37418ffad81d39324250ec101065d7af39264ab0d9f5c8d514029c5d4

Analysis

max time kernel
152s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 12:38

Target

36706e2e9195d1aed708012e91d16476.dll
Size

28KB
MD5

36706e2e9195d1aed708012e91d16476
SHA1

a96d4a8b4bbb5d6ddf68753fa7ecf7ff20aa5e79
SHA256

752379e37418ffad81d39324250ec101065d7af39264ab0d9f5c8d514029c5d4
SHA512

5d75e089e5c371cfca757663471fad0c3f3eace78a9f68833f6384bdafce4b6d366dd4a8b83b19d077b2ccffd0aae226fa11e4acdbf11801b55588b1197c04e6
SSDEEP

192:Gp7Y9ZpGMttv/FS1KdPl73fJPiY939T94toekDQKqNZgqrjQyKpct5Unswip+:Gp7mttnFpPBjNpskDM/oyKpct55r4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 1884	4540	rundll32.exe	90
PID 4540 wrote to memory of 1884	4540	rundll32.exe	90
PID 4540 wrote to memory of 1884	4540	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36706e2e9195d1aed708012e91d16476.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36706e2e9195d1aed708012e91d16476.dll,#1
  2⤵
  PID:1884