b416baac9ce0887c7c61fe2be5a0d8a4ae101b47c90d321e0fba2908ce373422

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 11:11

Target

50670c080f15770065b4430a4169fa65.dll
Size

46KB
MD5

50670c080f15770065b4430a4169fa65
SHA1

03c8048e2637e5e16b03904b4ee290156c4884fd
SHA256

b416baac9ce0887c7c61fe2be5a0d8a4ae101b47c90d321e0fba2908ce373422
SHA512

c5538b89438aaae2ffe1d210ec9d5638daecca3c11b6d5646bffeb9625154aebb993deb20aba737300e596929f0072addf385838b193d466e1a1e3002aab7c9a
SSDEEP

768:fmpM8peLohboGvEHATCjMAWGz3O+cGoCFA2EA+JStHr7AkCMql:faHoHuCj/WKouAxarFil

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2456	1480	rundll32.exe	16
PID 1480 wrote to memory of 2456	1480	rundll32.exe	16
PID 1480 wrote to memory of 2456	1480	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50670c080f15770065b4430a4169fa65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50670c080f15770065b4430a4169fa65.dll,#1
  2⤵
  PID:2456

memory/2456-0-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download