77a1d6f668683e3e1f132f6e44cf0cfe9afd4c78d1c43d59e3c7e5213e6e83ec

Analysis

max time kernel
140s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 07:35

Target

3c4376d5899eff01d314d05900bef000.dll
Size

45KB
MD5

3c4376d5899eff01d314d05900bef000
SHA1

0467e3c5cfcd33ae529ed837b5aba8ce38a0133f
SHA256

77a1d6f668683e3e1f132f6e44cf0cfe9afd4c78d1c43d59e3c7e5213e6e83ec
SHA512

dcb48bda7dba559ce6f5df93690baac3f9f496f4ccd5ab7e5d7e09ba21da04517d26fb7aef6c353b13824b926ee0eb1572e509d21feb93ab4292751f35fdd187
SSDEEP

768:xS/MqQ9/NQYggZ7Fz7AKbr1lduZIfspdGqX42DvkplJPmZ+:I/MqK/NQ7kgir1fMqlUZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2804	1488	rundll32.exe	14
PID 1488 wrote to memory of 2804	1488	rundll32.exe	14
PID 1488 wrote to memory of 2804	1488	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c4376d5899eff01d314d05900bef000.dll,#1
1⤵
PID:2804

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c4376d5899eff01d314d05900bef000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488