f074540f15e9ab2466d3a7d77ac19ffcf73e498eb8ea16f827406dc0e0465e8d

Analysis

max time kernel
161s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 06:37

Target

4fd969a2e3d4a8687ee416b84f30f53b.dll
Size

63KB
MD5

4fd969a2e3d4a8687ee416b84f30f53b
SHA1

cb5b1bd7567059e0967fa5f8aa6faef9ab80aa12
SHA256

f074540f15e9ab2466d3a7d77ac19ffcf73e498eb8ea16f827406dc0e0465e8d
SHA512

a4f1e81b7b2ab9d6917be1c86bce39be12a10ed790230efeb40666cecb94cdfaca65cc2e71d1120fa24d4886fe71fed21b534a38e8436b73bc5bb3afcc2fb2d6
SSDEEP

768:3EUs6lKOxyKfjkAG5Xqijth6UQIP9vqhVVxr+qtVqSkR1Fz4Z/jfOpuwSYzpcSG:3PEOxyjP3jthL9CrnJ2MZ/ySDSG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3312	4592	rundll32.exe	88
PID 4592 wrote to memory of 3312	4592	rundll32.exe	88
PID 4592 wrote to memory of 3312	4592	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fd969a2e3d4a8687ee416b84f30f53b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fd969a2e3d4a8687ee416b84f30f53b.dll,#1
  2⤵
  PID:3312

memory/3312-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download