cb5f1feb2504a6e8b365cf13e434dd8c83ff1fca7cbee1a8b21ec0ecb5a2ba84

Analysis

max time kernel
144s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 12:54

Target
nView.dll
Size 79KB
Sample240104-p491bsgaej
SHA256 dd261a5db199b32414c33136aed44c3ebe2ae55f18991ae3dc341fc43a1ef7f4
MD5 7ea17ffb336a7d8b24d62ba78151d264
SHA1 10f30319eb0f7f939e2e872fdcef2f17d448c924
SHA512 228a41ae99a82b9bc04e4cae7eb35c3b63588bcf454c9e3fa1f4b75bba7879ca9a9b5b4cb3c7ee8bbbeea8c65f31ad28a4b30c904fd78422ea0f2e44342739b8
SSDEEP 1536:GvOLlrQmbhbuJMuOQKF03eXZlVhdKShDkZkNsWVcd5KtAc/2jo:GvmfVkMuc03eXZkOE5mAc/2jo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3040	5028	rundll32.exe	14
PID 5028 wrote to memory of 3040	5028	rundll32.exe	14
PID 5028 wrote to memory of 3040	5028	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nView.dll,#1
1⤵
PID:3040

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nView.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028