c1a673df51c9a8fab6e452f49cfd8c30c2ac39acf74f8fa8ebc7636228f395c1

Analysis

max time kernel
146s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 05:48

Target

4fc0216a01af41bb083a0c49e90c79d5.dll
Size

255KB
MD5

4fc0216a01af41bb083a0c49e90c79d5
SHA1

41cbbc73549937494e78097f0a921ae47037c108
SHA256

c1a673df51c9a8fab6e452f49cfd8c30c2ac39acf74f8fa8ebc7636228f395c1
SHA512

a487ecd07797bfad82171c721acbfa2fea858b6595476f1c88354df980682c3a6bb28c1fb561ae720316a2ba0385ee1ac079c8f6e92aa6ff79ae8922f0d4ab94
SSDEEP

3072:25r6n8l+DQQWlfZgjIoSaP3Rz+et0YBRC1MfshQAzHXxhfEyhUQuez8RXn57SOKq:2ARYgVhp0nWyhyrXVt4/Ls7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 5036	452	rundll32.exe	16
PID 452 wrote to memory of 5036	452	rundll32.exe	16
PID 452 wrote to memory of 5036	452	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fc0216a01af41bb083a0c49e90c79d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fc0216a01af41bb083a0c49e90c79d5.dll,#1
  2⤵
  PID:5036