2145cc1bb4315c608aa187ccbabe3aa5699d71727aa65a2b0fef88f01e21c377

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 10:46

Target

f7aa8fbe5826351166c863d1edce8105.dll
Size

2.1MB
MD5

f7aa8fbe5826351166c863d1edce8105
SHA1

5a07b24e0c065feeafa6a833853ddfa31da122fa
SHA256

2145cc1bb4315c608aa187ccbabe3aa5699d71727aa65a2b0fef88f01e21c377
SHA512

8f2f31003fa4c1b0191c28585d8e7a738d00e89140c0984aec19cf899c37b8bd8dcafbdc82f334b602a10081288c312214e610fda031227d4321fe29f079bacc
SSDEEP

49152:CSvlFunQ9ZC1c/wBR2xIgpGc/Ln+dywOcLZFjtKP67HPle:CS3uQPxxIgpv+owOUHj8P6J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2828	3036	rundll32.exe	86
PID 3036 wrote to memory of 2828	3036	rundll32.exe	86
PID 3036 wrote to memory of 2828	3036	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7aa8fbe5826351166c863d1edce8105.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7aa8fbe5826351166c863d1edce8105.dll,#1
  2⤵
  PID:2828

memory/2828-0-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2828-1-0x0000000010000000-0x0000000010227000-memory.dmp

Filesize
2.2MB

Download
memory/2828-4-0x0000000002460000-0x000000000259D000-memory.dmp

Filesize
1.2MB

Download
memory/2828-5-0x0000000001FE0000-0x00000000020FE000-memory.dmp

Filesize
1.1MB

Download
memory/2828-6-0x0000000001FE0000-0x00000000020FE000-memory.dmp

Filesize
1.1MB

Download
memory/2828-8-0x0000000001FE0000-0x00000000020FE000-memory.dmp

Filesize
1.1MB

Download
memory/2828-9-0x0000000001FE0000-0x00000000020FE000-memory.dmp

Filesize
1.1MB

Download