56a539b0105f8c14c22cf6578f022777bb475c347cfd8a721de6c3764a5835cb

Analysis

max time kernel
0s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 12:41

Target

3683b940ec72e1ceef98987d93188f13.dll
Size

12KB
MD5

3683b940ec72e1ceef98987d93188f13
SHA1

5b690211b70ecdc489b060f339f9027b6163e3fa
SHA256

56a539b0105f8c14c22cf6578f022777bb475c347cfd8a721de6c3764a5835cb
SHA512

6615419b37ffcdf3273ae51408872103441d0f3253bc7a528f02f3456848d0c53ec5be089647fee8458fa3267b9e9564ec1798075584339ab86e7339a750cde2
SSDEEP

192:DxSKDmco6XCHnCyHGzkDeaLYdVcK1o9+9mrT7TMyLcPG6Or/TndFk87XhLA9Rkgw:9SXwMC4cV51U+K7NYPG6Kdh7X9AUBG6

Score

1^/10

Suspicious behavior: LoadsDriver 64 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 848	1420	rundll32.exe	12
PID 1420 wrote to memory of 848	1420	rundll32.exe	12
PID 1420 wrote to memory of 848	1420	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3683b940ec72e1ceef98987d93188f13.dll,#1
1⤵
PID:848

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3683b940ec72e1ceef98987d93188f13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420

memory/848-0-0x0000000025000000-0x000000002501A000-memory.dmp

Filesize
104KB

Download