9f8a5891d5efcbacfb89d892037be98871084da12726e65b62a4c63501898a48

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 20:15

Target

5461c702606411f61421d0a09ffe237b.dll
Size

101KB
MD5

5461c702606411f61421d0a09ffe237b
SHA1

16d5b934366f2fbbfd50799aa001a10f04f65685
SHA256

9f8a5891d5efcbacfb89d892037be98871084da12726e65b62a4c63501898a48
SHA512

4103d212cb8b7ce827c86358f5090f25a80abf0449b7d31f7eb26462a0bfced5b74489db63d8a845b442ff3ef20ab796a86b4c897c51ecf49836fa681ed437d2
SSDEEP

1536:FpsHkdQcOiG9wHwEBMqDRcYgQf9+8tW/aetizvpCKGueV:/sEROiG9xxqDR/gq9+8sSetOvpCLueV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 1072	3640	rundll32.exe	14
PID 3640 wrote to memory of 1072	3640	rundll32.exe	14
PID 3640 wrote to memory of 1072	3640	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5461c702606411f61421d0a09ffe237b.dll,#1
1⤵
PID:1072

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5461c702606411f61421d0a09ffe237b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640