b81e51821176d2afbbb5248dd096ac22e9dd18ba0f6055679d43f6acbc561513

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2024 19:32

Target

b81e51821176d2afbbb5248dd096ac22e9dd18ba0f6055679d43f6acbc561513.dll
Size

2.9MB
MD5

285be63a4f0737ed4119d01bf525cef2
SHA1

03c6665b135b103a1137257f8d126faa385b7ba9
SHA256

b81e51821176d2afbbb5248dd096ac22e9dd18ba0f6055679d43f6acbc561513
SHA512

5ee64e953d5aa357e060f2aecbff45e6f8bb52c2bdd462730c189dc6eb1366f2b7107382bb3a06a33da84079b91b869a568c55743daaf7af77435e1a1bfc4a62
SSDEEP

49152:+eSysjDubuOYfFWKEtue8Zn9FkeR2NIPnLg96U7HRnMMHxBt8ar/d8:hZsPubujFZu8O2PLg9fBHHPeah

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 364	2712	rundll32.exe	87
PID 2712 wrote to memory of 364	2712	rundll32.exe	87
PID 2712 wrote to memory of 364	2712	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b81e51821176d2afbbb5248dd096ac22e9dd18ba0f6055679d43f6acbc561513.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b81e51821176d2afbbb5248dd096ac22e9dd18ba0f6055679d43f6acbc561513.dll,#1
  2⤵
  PID:364