1ffb1b0431485ea09005bc51d2e50a354b0fe30c99ca50d0a8d3e5a329e83659

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 21:30

Target

3f12b562e32b6de257f7a4a2eb7ccd4b.dll
Size

104KB
MD5

3f12b562e32b6de257f7a4a2eb7ccd4b
SHA1

27755f973622e52447932034daf5ec42a3c08251
SHA256

1ffb1b0431485ea09005bc51d2e50a354b0fe30c99ca50d0a8d3e5a329e83659
SHA512

3365a802a62de27fba0ca3397ea493d968521d705568e7fc7acf588806d5c65d040c59e5bd482aa7e6b8fefedaaac2437da4ec2b2423933c094f278838d225f1
SSDEEP

768:amzMKn+EylcLLTpvMbX8lmKEN3lt2gJVBl69CzmF+ZU9QZU9hFnN89:am4K+JETp66mKA3l9Bl2CSF+zqFnN6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 3300	928	rundll32.exe	48
PID 928 wrote to memory of 3300	928	rundll32.exe	48
PID 928 wrote to memory of 3300	928	rundll32.exe	48

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f12b562e32b6de257f7a4a2eb7ccd4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f12b562e32b6de257f7a4a2eb7ccd4b.dll,#1
  2⤵
  PID:3300