6723aac56ab761890d476782aaaa2a4e455a3a460a309057404d5419e0ebd1f6

Analysis

max time kernel
145s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 01:00

Target
4a3ba94751ce56e624532dbb230d7116.dll
Size 12KB
Sample240108-bclxjaaec2
SHA256 6723aac56ab761890d476782aaaa2a4e455a3a460a309057404d5419e0ebd1f6
MD5 4a3ba94751ce56e624532dbb230d7116
SHA1 a646f5eaa349a47bb04be4711908ef4393991ef1
SHA512 b9f765975dc59832d405cd000d660558a2653dd7fcea3d6e5efbe3a8ed263b2fe8f91d36afd863d253ce97f87c1589613bff6af2b6ef67d81ac84c4c32055952
SSDEEP 192:W0t7eAMgyYjL5JLd8EEG7+TXkRo/oU2yEOv3gwts4lDfjHOM/NZxb/CWN0hz1O:W0t7ePgh/dpEG7+TXX/o7ydv3gwtfbO4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 2032	496	rundll32.exe	89
PID 496 wrote to memory of 2032	496	rundll32.exe	89
PID 496 wrote to memory of 2032	496	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a3ba94751ce56e624532dbb230d7116.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a3ba94751ce56e624532dbb230d7116.dll,#1
  2⤵
  PID:2032

memory/2032-0-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/2032-1-0x0000000010000000-0x0000000010007000-memory.dmp

Download