3dd82f6750766fe0aae9c0b0c6bb86a0723cdbc889f5ce07fc13fe4300e10f7b

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2024, 21:07

Target

639be7c6abb803b0b0a2d0179a065674.dll
Size

11KB
MD5

639be7c6abb803b0b0a2d0179a065674
SHA1

e624244b2096759cd15c5dfced652475c0b7196b
SHA256

3dd82f6750766fe0aae9c0b0c6bb86a0723cdbc889f5ce07fc13fe4300e10f7b
SHA512

50c6b712672e34d4cbae02edbfd2212b4b48e622acc07f71d786e6d36f0a8bdfe86a6ee5dae83011ee8d1ff9468d219ce4e80a546523deabbbb7c25da56b723f
SSDEEP

192:KbBO8F2RSRBrjjGQCQdPwREI0YwU6jsC6Jbrx9TKB7AqYBCUTd14bDgLkgUw9r:Kb8RRwBrjjqQFwREIwj8J3TKIcYEbd0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1212	2372	rundll32.exe	81
PID 2372 wrote to memory of 1212	2372	rundll32.exe	81
PID 2372 wrote to memory of 1212	2372	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\639be7c6abb803b0b0a2d0179a065674.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\639be7c6abb803b0b0a2d0179a065674.dll,#1
  2⤵
  PID:1212

memory/1212-0-0x0000000025000000-0x000000002501C000-memory.dmp

Filesize
112KB

Download