63f3957a02b805d1a9d667e6db893afea7004e4abe1190ca516854b0be227859

Analysis

max time kernel
155s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 03:00

Target

554d2555964f501540b13d3258d9ea6c.dll
Size

342KB
MD5

554d2555964f501540b13d3258d9ea6c
SHA1

464ba6e2b6999c20a680176c46b6c0f56c0d9c7d
SHA256

63f3957a02b805d1a9d667e6db893afea7004e4abe1190ca516854b0be227859
SHA512

f223bfec7c4ca44db757c343c2c4c2703416f76ae587a723d2c2e033b1b7b542ffffa45c003c031b7d2f08beb64e0c3bcffd7df7cf8177b88d561bd08c6a127c
SSDEEP

6144:DRJtRY6NpLBQ2Q8m+TlrnWmQ2rz57xIYiSa6QrrPA/EQnQ:DRe6NpLX9ZpbWmQ2BiSGrE/zn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1852	4704	rundll32.exe	88
PID 4704 wrote to memory of 1852	4704	rundll32.exe	88
PID 4704 wrote to memory of 1852	4704	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\554d2555964f501540b13d3258d9ea6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\554d2555964f501540b13d3258d9ea6c.dll,#1
  2⤵
  PID:1852