af8676704507c6762eed88282bb0a53f6aeadf8a0353dd80be54357482bf9471

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 11:19

Target

40b90474b5dab2b46f9547c337b8e6e1.dll
Size

281KB
MD5

40b90474b5dab2b46f9547c337b8e6e1
SHA1

b4ca535018b34647b0184f89d46ce8c1653ed481
SHA256

af8676704507c6762eed88282bb0a53f6aeadf8a0353dd80be54357482bf9471
SHA512

f74e6dae2ac28fba09cdf9291822dd77ebaafd203453f90ec57636cc5b859775b65427ffc055bfeab8b57a9dccc469223c22ee18cb93d86be27543e5a0b95639
SSDEEP

6144:03/R7DMMcicmhD2UdqwCCJn/ZyKXIzmhWbMtOonmkC2REXZehgaEPN5:gNDMM7RPdqwCCJn/ZyKXIzmhWSbmkCIu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4800	2952	rundll32.exe	16
PID 2952 wrote to memory of 4800	2952	rundll32.exe	16
PID 2952 wrote to memory of 4800	2952	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40b90474b5dab2b46f9547c337b8e6e1.dll,#1
1⤵
PID:4800

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40b90474b5dab2b46f9547c337b8e6e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952