2ade80fb962db0cc018d09d2719d60ff2bd96f0f0f01ad96917aaa8057ac4f19

Analysis

max time kernel
133s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 13:40

Target

5b61f2269456c3690a1061daa810c5c3.dll
Size

17KB
MD5

5b61f2269456c3690a1061daa810c5c3
SHA1

c35900b59f8f58067102f03241eb2b2c69fb7c1b
SHA256

2ade80fb962db0cc018d09d2719d60ff2bd96f0f0f01ad96917aaa8057ac4f19
SHA512

33baf01023080684554aff148ad34b50559b78892c92cfdc95764c1e355ff8ec289d01841db7b12228ffc41862916917b281f85e810dccda52e0d6b6fcffaca6
SSDEEP

384:OHC5sxmXBd03E/jnspVMzuYV1mf7Mw39sa0b0U/vQOglx1TzOjb:Oi+x0dYErqVMzuwEMwNT20U/vgFC/

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1400	2064	rundll32.exe	73
PID 2064 wrote to memory of 1400	2064	rundll32.exe	73
PID 2064 wrote to memory of 1400	2064	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b61f2269456c3690a1061daa810c5c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b61f2269456c3690a1061daa810c5c3.dll,#1
  2⤵
  PID:1400

memory/1400-0-0x0000000025000000-0x0000000025027000-memory.dmp

Filesize
156KB

Download