618043e20fc0abd33cf23756da39b73901c9eaa7fd505f95c3c6ae6028bea738

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 22:44

Target

421a540467f81083dd652d78ba2b9744.dll
Size

132KB
MD5

421a540467f81083dd652d78ba2b9744
SHA1

ce752a4cfd0d1f460bc41e662f487371c3ba892e
SHA256

618043e20fc0abd33cf23756da39b73901c9eaa7fd505f95c3c6ae6028bea738
SHA512

691234e60bbe18b9fce5cd44f500f41c39a0cf4862e1348718b4944ee6558135714f0d35c82db35e72a7f42e934b00dde20e2bfa2b19920b53427b30cb9adfa9
SSDEEP

3072:bm8K7Y0dBa/EIyvdza3m6AhIfYl3/YGlnMqqDLy/NlK1pn:y8K75BjaWNhIfYOLqqDLuNgn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4940	4828	rundll32.exe	47
PID 4828 wrote to memory of 4940	4828	rundll32.exe	47
PID 4828 wrote to memory of 4940	4828	rundll32.exe	47

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\421a540467f81083dd652d78ba2b9744.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\421a540467f81083dd652d78ba2b9744.dll,#1
  2⤵
  PID:4940

memory/4940-0-0x0000000002D70000-0x0000000002D7A000-memory.dmp

Filesize
40KB

Download
memory/4940-4-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download