88f45ad4e085d7a23ea03d6978f4a89b0e04028ca42888d669185f64680066a4

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 22:45

Target

54c9f8222c47dff586c16761e70a25e1.dll
Size

56KB
MD5

54c9f8222c47dff586c16761e70a25e1
SHA1

7a7154d8fac5ad0df3d7e41555b1a6f0754524f2
SHA256

88f45ad4e085d7a23ea03d6978f4a89b0e04028ca42888d669185f64680066a4
SHA512

86bf84dfb161c553349ad03486c5a3e473769defd1d208572ef5789078d29ae199540d97adb7def6295ef78108130f894070a16e577eb40dee772230dd072508
SSDEEP

768:wCHEqA1kiQh+CnbaQlZeNJlr9LBGIKKyUCzvoz82tmA4q9qCHYtnFZIg:3kqA1ZQhrgN1LdQqmAxYtn/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4820	2420	rundll32.exe	23
PID 2420 wrote to memory of 4820	2420	rundll32.exe	23
PID 2420 wrote to memory of 4820	2420	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54c9f8222c47dff586c16761e70a25e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\54c9f8222c47dff586c16761e70a25e1.dll,#1
  2⤵
  PID:4820