a79534282870e72ba451f32df3b332c24a5ef0266430ab1c8d6029cf766bc80e

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:07

Target

3932ee11add70dbfc8d457f1d3cde4e6.dll
Size

5KB
MD5

3932ee11add70dbfc8d457f1d3cde4e6
SHA1

9236cb98a7aad5e2b75276fbef389d0f245dcf45
SHA256

a79534282870e72ba451f32df3b332c24a5ef0266430ab1c8d6029cf766bc80e
SHA512

53d4468a866029c69971bd2a09c28e7dae186b778b3d7b9dcea0def9086e90ce06cfe56f243afb99fccacc8c74ab49a0fc05b73cae127cea1710cdde5e475afa
SSDEEP

96:TDtKeaZ44grGx+0ZskmL20R7d5JsaLsRk0BbW0qH5iFDHa1kgcwQwTK1:ntE8Os7xRXJsysR/EoxmkgUwu1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4332	2916	rundll32.exe	19
PID 2916 wrote to memory of 4332	2916	rundll32.exe	19
PID 2916 wrote to memory of 4332	2916	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3932ee11add70dbfc8d457f1d3cde4e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3932ee11add70dbfc8d457f1d3cde4e6.dll,#1
  2⤵
  PID:4332

memory/4332-0-0x0000000025000000-0x0000000025013000-memory.dmp

Filesize
76KB

Download