dc17b2c65dcd0675013eeaba3d1f09940c054d07cb51a9a5c4fa8f372e2877f1

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 04:19

Target
4a6c04ed816dd24e716de805c5acf354.dll
Size 32KB
Sample240108-ex14qscab4
SHA256 dc17b2c65dcd0675013eeaba3d1f09940c054d07cb51a9a5c4fa8f372e2877f1
MD5 4a6c04ed816dd24e716de805c5acf354
SHA1 7e517d1be090dbcad568ae8a1ec688dbb3b80ee1
SHA512 0ce4a81e9b6a60858a7ebbc22c7f16f73f525f9c46ecb9cef81b19bb59393cc201a5bb49d0fa4192030f631dd44321a2a3ff643f29413f6e0587e189fe90290e
SSDEEP 768:tZ2I7fc/zqbCP7yvReKERlhCDglRbBWbkhQ:t0Iw/zqA7QReKED8klRbBWbiQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 716	3424	rundll32.exe	12
PID 3424 wrote to memory of 716	3424	rundll32.exe	12
PID 3424 wrote to memory of 716	3424	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a6c04ed816dd24e716de805c5acf354.dll,#1
1⤵
PID:716

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a6c04ed816dd24e716de805c5acf354.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3424