3e0b136c53232a3ab6523d2a1f9b99304fcadb5469fcdb846fd0ebfa48183b7e

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 22:57

Target

54d00edf103c2f45137d453d60224b48.dll
Size

133KB
MD5

54d00edf103c2f45137d453d60224b48
SHA1

1c0e75967c6d7b733c0045b954d896fd157faa2d
SHA256

3e0b136c53232a3ab6523d2a1f9b99304fcadb5469fcdb846fd0ebfa48183b7e
SHA512

e41ee08be48a79e725b2d70cd7a52779e22b791af4f5badfcfe1a77f3b1ad528879845d5cad5db91b47488c7f198d2264c14228c8906504be97b0e7f7a2d3dcf
SSDEEP

1536:To2KIfBAqmmJtrBRgNY71Hc56eN+GwP5Oc1p8y0jZtEbmBwLkHSIiPErqdfuA5Vt:TEBNmbsC6XM1MxamFLnxDRGv8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2600	4640	rundll32.exe	36
PID 4640 wrote to memory of 2600	4640	rundll32.exe	36
PID 4640 wrote to memory of 2600	4640	rundll32.exe	36

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54d00edf103c2f45137d453d60224b48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\54d00edf103c2f45137d453d60224b48.dll,#1
  2⤵
  PID:2600

memory/2600-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download