75f4c5e6fe76cad7ba6def5a8957e1f19d8c521204ec6474e3c7ccc8e42d6b88

Analysis

max time kernel
143s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 05:00

Target
558dfd8cd2b6fe27769806e97ae879df.dll
Size 24KB
Sample240112-fm3p9afaap
SHA256 75f4c5e6fe76cad7ba6def5a8957e1f19d8c521204ec6474e3c7ccc8e42d6b88
MD5 558dfd8cd2b6fe27769806e97ae879df
SHA1 e8512cd875f6d15b13314ddf7a8dfd75a7c2014a
SHA512 4e8092e9798c1c86a0aba6051ab023c68168cb321d37d2ff667f275e39f3b3b9da4a1ed696349dbc8a107278b7c138aa4f63142ee0f726fc954b6ab9ad1cc655
SSDEEP 384:+qNjUlG3pdL13rUrySthfPU5aMkjkG/Gx3bRk87VpSqVXE9bD3ecTNltzgnHVvni:qGn3KlhNMG/Gk87yqVXeD1TNltz+v+ZD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 1912	4324	rundll32.exe	14
PID 4324 wrote to memory of 1912	4324	rundll32.exe	14
PID 4324 wrote to memory of 1912	4324	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\558dfd8cd2b6fe27769806e97ae879df.dll,#1
1⤵
PID:1912

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\558dfd8cd2b6fe27769806e97ae879df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324

memory/1912-0-0x0000000002B40000-0x0000000002B47000-memory.dmp

Download