209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5

Analysis

max time kernel
87s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 23:55

Target

CommonLoggingExtension.dll
Size

146KB
MD5

1e1f3ab10b4b9c889726b0241c5ef28b
SHA1

a0fbc28a325b0f6e149ea17e5467c73fac57c521
SHA256

aab701b63af2beea75bbb6851706fa74c026013c42d0034313845ab78a544009
SHA512

bdb91ff5f315dc3990d4e658d4d7e8e6762eb3e0ee4a5e426ef0af90504afb1b4e4ce3881c66dd4bb2da0fe3a12253dcab2bb722cadaf9634fe297e14fc13d75
SSDEEP

3072:FusvF08eTEvmexrPySOLAZzh+ULxR32GQZy5Zu2HxGnk46WSsCKzDur3WMQ8TFGI:FusvF0FIvmYrPySOLAdh+uR32GQZK02M

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3416	2884	rundll32.exe	86
PID 2884 wrote to memory of 3416	2884	rundll32.exe	86
PID 2884 wrote to memory of 3416	2884	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonLoggingExtension.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonLoggingExtension.dll,#1
  2⤵
  PID:3416