d3d9529d5045a031c69f4d4cbb5909f97d5ef95a10fd9bd5d2c9bcc3a2b94a68

Analysis

max time kernel
151s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:03

Target

39152f51f668507d8fd50317e0dd0c0c.dll
Size

84KB
MD5

39152f51f668507d8fd50317e0dd0c0c
SHA1

2aef383b2c4fe25a49b67ce11f1d7e7794460a45
SHA256

d3d9529d5045a031c69f4d4cbb5909f97d5ef95a10fd9bd5d2c9bcc3a2b94a68
SHA512

53fdc420336a6b8468118f956b0d6d76d525002d23bc4ab1038d524f0fe9cfffb3c91ded61d1cb4ca44d82b2e7db4dbd2a0969813705c295b222fcc1ff3e8260
SSDEEP

1536:6JcPXkhhCZ+rtOKM3wdymPoNXZryG9K0JjKP/f2Wo:fqhCZ+ZOKfd1PoNXZ19SPnRo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1860	2184	rundll32.exe	88
PID 2184 wrote to memory of 1860	2184	rundll32.exe	88
PID 2184 wrote to memory of 1860	2184	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39152f51f668507d8fd50317e0dd0c0c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39152f51f668507d8fd50317e0dd0c0c.dll,#1
  2⤵
  PID:1860

memory/1860-0-0x0000000000650000-0x0000000000659000-memory.dmp

Filesize
36KB

Download