8172aebd9b46e1932b14fac62c865bd105ebe0b0068d7203e2638f8adf5c503e

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 11:50

Target

5b2b17879d211e0da3a4deb2574bf88c.dll
Size

139KB
MD5

5b2b17879d211e0da3a4deb2574bf88c
SHA1

f109c340e1c69599227f3c0f4679669acc56340b
SHA256

8172aebd9b46e1932b14fac62c865bd105ebe0b0068d7203e2638f8adf5c503e
SHA512

c541ba410aba82ef3541fb0e93cc6d3040e73d9f99410dd4875b3629bce65573aa88fa3aafb2630542fe3475874e74420a2418766265ab25c9a5ded52cc5f132
SSDEEP

3072:7htLEzn0pNEwO4TQ8c2bddzqBo3XCC4NrnGgHqb3hHEfOjqXXBxu5y9W3QYzlA:7jLp6dX2pdzmrCXgH92jyXSQYa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3408	3432	rundll32.exe	91
PID 3432 wrote to memory of 3408	3432	rundll32.exe	91
PID 3432 wrote to memory of 3408	3432	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b2b17879d211e0da3a4deb2574bf88c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b2b17879d211e0da3a4deb2574bf88c.dll,#1
  2⤵
  PID:3408

memory/3408-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3408-1-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download