2695796ed0d9687801b1db96d30878386f53cafda6d8ab6f9ce0058feee285f8

Analysis

max time kernel
161s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2024 16:00

Target

3e67b07ebdede3c7276be780e004c35c.dll
Size

60KB
MD5

3e67b07ebdede3c7276be780e004c35c
SHA1

b61e4405aaa74c2096f26fc8f0a09002ca045234
SHA256

2695796ed0d9687801b1db96d30878386f53cafda6d8ab6f9ce0058feee285f8
SHA512

86853946aac631ca157aabd262f5694cda2efdd467af27a02816b490bf935725ae8e00e9ccb677f425725156a9c553a3ebce5dd976a272a95dee0986b6131ece
SSDEEP

768:iC3dG0ZPYhmWJjcbZD5qmjXh2JVUc2HFj9oy/I94h8:iC3dG0ZkmNrq6uUh7oEI94h

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4640	4028	rundll32.exe	90
PID 4028 wrote to memory of 4640	4028	rundll32.exe	90
PID 4028 wrote to memory of 4640	4028	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e67b07ebdede3c7276be780e004c35c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e67b07ebdede3c7276be780e004c35c.dll,#1
  2⤵
  PID:4640

memory/4640-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download