63dfa9fc235bfdc8ebc8b47bed422b8c4c5dd88e068c39dc8aeb632277edcaae

Analysis

max time kernel
147s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 20:34

Target

49b2fcd947979749b15d607c6b6caa19.dll
Size

349KB
MD5

49b2fcd947979749b15d607c6b6caa19
SHA1

3e6c82d9e0e619a73cccff2eb73edad00fc6a7f2
SHA256

63dfa9fc235bfdc8ebc8b47bed422b8c4c5dd88e068c39dc8aeb632277edcaae
SHA512

0d34132e9382da66d8d52fc08cb94c593c5ff78b59a38ede99a560ad773f0628e2dc117f855ec49c9208b36ba34eb467e959002cb7df3dcf49f8e5ebdfb6b1e7
SSDEEP

6144:tcsdENqrqzqf5q14lauU4tCu/D5nyLMRbbwY0uEnbxDYZ+aG3cf6rh:rdENqwZ6p6Znds+306r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 5040	1404	rundll32.exe	14
PID 1404 wrote to memory of 5040	1404	rundll32.exe	14
PID 1404 wrote to memory of 5040	1404	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49b2fcd947979749b15d607c6b6caa19.dll,#1
1⤵
PID:5040

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\49b2fcd947979749b15d607c6b6caa19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

memory/5040-1-0x0000000002390000-0x0000000002490000-memory.dmp

Filesize
1024KB

Download
memory/5040-0-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download