5aee2b253609a63e03fe3c92c60402f306a3222ff2046bcef6998d2032d85891

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 16:04

Target
56e6403952449be661ec6022dd07ddcb.dll
Size 332KB
Sample240112-th57gabcal
SHA256 5aee2b253609a63e03fe3c92c60402f306a3222ff2046bcef6998d2032d85891
MD5 56e6403952449be661ec6022dd07ddcb
SHA1 de4ea2b47313b0adb318e94cd58071dbba5cb2cd
SHA512 afe5dd4dfe3c2f6a8eee37b4e550e9eddcde34a5e6883ad7d781cd2d039499333f1db1834c6da69ae6a81c94d93e761f4adbf0d009a477916f4ed8fa9d15cfd6
SSDEEP 6144:Q1SKdnzDt8vVihY+jEEEwdRhQ3n3NtG6ocWqEyXqkq2Q4ur9nmxRI5i:ySkt8tUHEoC1aqK12Q4S9nFi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 792	4908	rundll32.exe	50
PID 4908 wrote to memory of 792	4908	rundll32.exe	50
PID 4908 wrote to memory of 792	4908	rundll32.exe	50

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56e6403952449be661ec6022dd07ddcb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56e6403952449be661ec6022dd07ddcb.dll,#1
  2⤵
  PID:792