75f058c59781c6729a07729b1aa4e8386eb38a536b37bdcf9533ae4b730d362d

Analysis

max time kernel
138s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 06:19

Target

4aa98e34841506e7ab94621d52d57898.dll
Size

7KB
MD5

4aa98e34841506e7ab94621d52d57898
SHA1

cbf32c86e55fd65d47edf1c85a079440ec2cbb58
SHA256

75f058c59781c6729a07729b1aa4e8386eb38a536b37bdcf9533ae4b730d362d
SHA512

aaf97c315c7b017b87d6824eb24041cecaff4847b9f33619316f07181d2ec47f4528c6367323614a84672eed6f4b20883786cfa4a020b0f94dcc964e3c0b505b
SSDEEP

48:KIQ3oi2rU3687g89cXw+FnPnPuNZx+z4d/+tstiUOaOTGOAWEevm4fO4AveAup+R:lPrH8M89cX5PPuF+zIhvjhUimV8Jl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1568	3892	rundll32.exe	14
PID 3892 wrote to memory of 1568	3892	rundll32.exe	14
PID 3892 wrote to memory of 1568	3892	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aa98e34841506e7ab94621d52d57898.dll,#1
1⤵
PID:1568

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4aa98e34841506e7ab94621d52d57898.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3892