14c673b8cf8c152cb72bc8c2ad7800155743b01e8d025daf358e49d519abc7d7

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 04:10

Target
4a673e2f11fe8d712002599553a6b6aa.dll
Size 42KB
Sample240108-erlf4abhb4
SHA256 14c673b8cf8c152cb72bc8c2ad7800155743b01e8d025daf358e49d519abc7d7
MD5 4a673e2f11fe8d712002599553a6b6aa
SHA1 c7db1cb2a424f94f68878c472f46c50451de3e5c
SHA512 698109d0715e39f05dd83260ed701143f42ef2df3a71e92d4cafab410d491715efa09d6d7b3ce4e9bd67b391c05441b34f56f17cd7ac11bd75146eb00a7dea32
SSDEEP 768:TTCMS0D+/H3NNglWySiES2DSZVEWWyZb+ZejVFHs:X8H/XrsESiSHjW+KZejrM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1012	2548	rundll32.exe	68
PID 2548 wrote to memory of 1012	2548	rundll32.exe	68
PID 2548 wrote to memory of 1012	2548	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a673e2f11fe8d712002599553a6b6aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a673e2f11fe8d712002599553a6b6aa.dll,#1
  2⤵
  PID:1012

memory/1012-0-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1012-1-0x00000000007D0000-0x00000000007D2000-memory.dmp

Download