53c198926386540ad97ba95f0bc93566c51cbbfa4361e3d9a09e2d9a00ea2d6c

Analysis

max time kernel
157s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 11:02

Target

4e20963df8d05afa625acb27982acb40.dll
Size

25KB
MD5

4e20963df8d05afa625acb27982acb40
SHA1

fbe9bd53b1bc209ea6cce5656412035945c2f07f
SHA256

53c198926386540ad97ba95f0bc93566c51cbbfa4361e3d9a09e2d9a00ea2d6c
SHA512

046596687390e0be6603e1d37abb4d1fefb2e13b6c4409d98a921b4cf8dd09a18d2ae7a4945bef7d0c75bc84966c10f9c3d06fa97a754441de0ca27687b2b25f
SSDEEP

384:jPpBZUOCGiSmuIV1707PbuLfdGrtjx5NM5/DUDi92OKUHpoWcEB1kg:jPpBGYXRTuLfoVcl2OK8oREDk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4684	1816	rundll32.exe	89
PID 1816 wrote to memory of 4684	1816	rundll32.exe	89
PID 1816 wrote to memory of 4684	1816	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e20963df8d05afa625acb27982acb40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e20963df8d05afa625acb27982acb40.dll,#1
  2⤵
  PID:4684