6a0bb8e3a1526e07004a56f043e6b9e094f0f0f4082e650a4138eb8f1911e88f

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 19:23

Target

41b5d9513ebdddd08a4554727571c201.dll
Size

12KB
MD5

41b5d9513ebdddd08a4554727571c201
SHA1

d6a896cff1e42134923d6baf7c6bff3b24f218a6
SHA256

6a0bb8e3a1526e07004a56f043e6b9e094f0f0f4082e650a4138eb8f1911e88f
SHA512

782aeb54cc9b5e032030a1970a81207049e25f5fadf1660aa0c38b73677d8c3b52d5a0b889f7dfd8fcfde05667cf46fcab529711b5827b8405eb1cc90c2f2883
SSDEEP

192:WL9BR4VJBTKvsK3vrCS8veuwSkmDZDB2FnwsVOZzPCez+aMbNGqzaN/b:WRB6vKvjCzmuumDB8FnwsVON6eiaMbcR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 2328	960	rundll32.exe	14
PID 960 wrote to memory of 2328	960	rundll32.exe	14
PID 960 wrote to memory of 2328	960	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41b5d9513ebdddd08a4554727571c201.dll,#1
1⤵
PID:2328

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41b5d9513ebdddd08a4554727571c201.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

memory/2328-0-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download