72ca9522058d3c9132f8521a2f51d39b79ee996d281acdbac44d90b17700d268

Analysis

max time kernel
160s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 16:53

Target

3e825c2cf7c1f67edc9d4ff070a85a52.dll
Size

27KB
MD5

3e825c2cf7c1f67edc9d4ff070a85a52
SHA1

4e2ef5a596c90f84fc919be52c03aa7acd30b2a1
SHA256

72ca9522058d3c9132f8521a2f51d39b79ee996d281acdbac44d90b17700d268
SHA512

8bb9988465d7f384eb6248d1da7bf3f39ae158f3c8d3644e57f57bb10092693388c58e32183ba175bc6a812e29b8a9f0fe4de17b0dc988e8b55fb0b0bcf2bdd0
SSDEEP

384:CAHxUS0qujV5KnGQWxq9wT0laYYMUwpEIOT0CuUxCEqpgkYpAzVkNF7:fKS0quR50GQfOQlBvpwnuUcbVkz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 4352	2260	rundll32.exe	90
PID 2260 wrote to memory of 4352	2260	rundll32.exe	90
PID 2260 wrote to memory of 4352	2260	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e825c2cf7c1f67edc9d4ff070a85a52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e825c2cf7c1f67edc9d4ff070a85a52.dll,#1
  2⤵
  PID:4352

memory/4352-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download