16b96e14b2d249d4b186cb50763cd54a4bf757e6ecd1e9a1965c3a740f5fd28c

Analysis

max time kernel
149s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 19:28

Target

4c444d43e6894fca04c6e5aa92654210.dll
Size

70KB
MD5

4c444d43e6894fca04c6e5aa92654210
SHA1

e087bd50be6b3b15cf55b8259e3834c4941920be
SHA256

16b96e14b2d249d4b186cb50763cd54a4bf757e6ecd1e9a1965c3a740f5fd28c
SHA512

b74f0e0aab246727e0cd2608c9c3f730354f7b8860dc09a2b763cf08396138c83dc7365e2e2857686430c8261b8bbbb19ba0895a6fb34e5a672428cf9bc4b1ad
SSDEEP

1536:yUsNOgeGgqLdupHeP+dZCUlL+DmWQFKjA3FOSpGXP:yUsNOgeGg1+PwQKWQFKj1wGf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3692	744	rundll32.exe	15
PID 744 wrote to memory of 3692	744	rundll32.exe	15
PID 744 wrote to memory of 3692	744	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c444d43e6894fca04c6e5aa92654210.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c444d43e6894fca04c6e5aa92654210.dll,#1
  2⤵
  PID:3692