3c5d9d554638e33ccbcbe9a6c0a517d4f1a0d69cebf885b36651060b15923d5f

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:53

Target

38c60da098e409045ea43925193b644a.dll
Size

95KB
MD5

38c60da098e409045ea43925193b644a
SHA1

a39359288b60f5c92a9440780951cb043d3c36d5
SHA256

3c5d9d554638e33ccbcbe9a6c0a517d4f1a0d69cebf885b36651060b15923d5f
SHA512

67869abb55ea573641329e92cfc4e7f8f47f702436a7f4d389e069a9b7c9f58e89db958ca009fbfcb93602a5f642a78dc521a4bee8f98b38ed70e3b875c783e9
SSDEEP

1536:Of8fACeV3VcXwUDqi3iAJFodZ2JlHVOQdZOEtumZ5qt1dlNV9Ft1doK2Oc0d1JjS:5AC8VcXw6qiyiGdZUb/XOEt62Oc0d1/4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 2336	4176	rundll32.exe	15
PID 4176 wrote to memory of 2336	4176	rundll32.exe	15
PID 4176 wrote to memory of 2336	4176	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c60da098e409045ea43925193b644a.dll,#1
1⤵
PID:2336

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c60da098e409045ea43925193b644a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176