1ffb1b0431485ea09005bc51d2e50a354b0fe30c99ca50d0a8d3e5a329e83659

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 21:30

Target
3f12b562e32b6de257f7a4a2eb7ccd4b.dll
Size 104KB
Sample240103-1cgp9aahen
SHA256 1ffb1b0431485ea09005bc51d2e50a354b0fe30c99ca50d0a8d3e5a329e83659
MD5 3f12b562e32b6de257f7a4a2eb7ccd4b
SHA1 27755f973622e52447932034daf5ec42a3c08251
SHA512 3365a802a62de27fba0ca3397ea493d968521d705568e7fc7acf588806d5c65d040c59e5bd482aa7e6b8fefedaaac2437da4ec2b2423933c094f278838d225f1
SSDEEP 768:amzMKn+EylcLLTpvMbX8lmKEN3lt2gJVBl69CzmF+ZU9QZU9hFnN89:am4K+JETp66mKA3l9Bl2CSF+zqFnN6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 3300	928	rundll32.exe	48
PID 928 wrote to memory of 3300	928	rundll32.exe	48
PID 928 wrote to memory of 3300	928	rundll32.exe	48

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f12b562e32b6de257f7a4a2eb7ccd4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f12b562e32b6de257f7a4a2eb7ccd4b.dll,#1
  2⤵
  PID:3300