dfce6e2f713a61d4ecafc520c5c21c19baeea2f70dc3f6c5c056971a29e85c6a

Analysis

max time kernel
114s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 10:02

Target
dfce6e2f713a61d4ecafc520c5c21c19baeea2f70dc3f6c5c056971a29e85c6a.dll
Size 241KB
Sample240108-l291rsffaj
SHA256 dfce6e2f713a61d4ecafc520c5c21c19baeea2f70dc3f6c5c056971a29e85c6a
MD5 65d81d7981af3fce5c34e52b0ed34b95
SHA1 dcf551d958f5cac2247df5e979246e599c94bc8a
SHA512 36b0b25ad2b19c11a8e341e1af8812a4e38ec60435fa5f783bf3cb3657fe1020068dd1154afad84ae075f5747e234d8c83e5d1dfc99229a9e7169e06c5c3c052
SSDEEP 3072:JM8lPYaCdOxkXwl0emt5w6cdQ9vDdkAhLFMwFDx0T9TBf68D4kmyunOKnI6lCpbY:FUoSc69vDdlhpFV+9TBi1nOKI6lC+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3848	4564	rundll32.exe	43
PID 4564 wrote to memory of 3848	4564	rundll32.exe	43
PID 4564 wrote to memory of 3848	4564	rundll32.exe	43

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfce6e2f713a61d4ecafc520c5c21c19baeea2f70dc3f6c5c056971a29e85c6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfce6e2f713a61d4ecafc520c5c21c19baeea2f70dc3f6c5c056971a29e85c6a.dll,#1
  2⤵
  PID:3848