7e1bb45224267a004ea078fb422147e7bf493d7f30b0518f999c5749f3c49810

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2024 22:28

Target

63c5911da1b456cf0963d91153b7a5c7.dll
Size

143KB
MD5

63c5911da1b456cf0963d91153b7a5c7
SHA1

ba49a471302d4756c5678185cdc5f57a3333620f
SHA256

7e1bb45224267a004ea078fb422147e7bf493d7f30b0518f999c5749f3c49810
SHA512

584af5b225fa9e1fd1a9182760db1c7177e79cae1d2892ae717e6cdeba90372ec4d744e3f79cdd03c01eab0acc88dd4a46d91a8d2792d6c76350ac6a45b0ce05
SSDEEP

3072:JFvVtCgw5sp77USOGG/AdCNOG8xXWWVB0oKlTAHefL1XLjcpouH:JNVtCy7YJG4AWoB0rlTeefZXLjc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 1392	4028	rundll32.exe	87
PID 4028 wrote to memory of 1392	4028	rundll32.exe	87
PID 4028 wrote to memory of 1392	4028	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63c5911da1b456cf0963d91153b7a5c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63c5911da1b456cf0963d91153b7a5c7.dll,#1
  2⤵
  PID:1392

memory/1392-0-0x0000000000AB0000-0x0000000000B54000-memory.dmp

Filesize
656KB

Download
memory/1392-1-0x0000000000AB0000-0x0000000000B54000-memory.dmp

Filesize
656KB

Download
memory/1392-3-0x0000000000AB0000-0x0000000000B54000-memory.dmp

Filesize
656KB

Download
memory/1392-4-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1392-2-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1392-5-0x0000000000AB0000-0x0000000000B54000-memory.dmp

Filesize
656KB

Download