a8ab2b68b47d04a364ba0ef2456e31652dd66faaa6ec0d497b0194da1717b256

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 01:31

Target

71162b6002a5cf89625e3e94d97fcaee.dll
Size

228KB
MD5

71162b6002a5cf89625e3e94d97fcaee
SHA1

32081ef565541e874e006119d19cd42deee96a7e
SHA256

a8ab2b68b47d04a364ba0ef2456e31652dd66faaa6ec0d497b0194da1717b256
SHA512

777682bdad62d208dd59f80129e51f773d409cf27cb62556024bb214c9e3dd5035a31c9946e419755044cea5fd450527469668d67259ee27a3f64a149d2b3f0a
SSDEEP

6144:vv/Z9ZVGyqwU3DANtt8p1lqjiUlEyuVqNYanbPE5twhGd5:vv/Z9ZVGyqwU3DANttIqjiKEyuVqhnjt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 648	4040	rundll32.exe	85
PID 4040 wrote to memory of 648	4040	rundll32.exe	85
PID 4040 wrote to memory of 648	4040	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71162b6002a5cf89625e3e94d97fcaee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71162b6002a5cf89625e3e94d97fcaee.dll,#1
  2⤵
  PID:648