242adf2a7a19d86ef979e6fe492af9075eafa02c19bccf79474a3cbb799832b1

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 05:42

Target

71998ae907f87e6a3fab5025e70a8b85.dll
Size

284KB
MD5

71998ae907f87e6a3fab5025e70a8b85
SHA1

d8f6ce4731366f037f855dca403af528cabe4edb
SHA256

242adf2a7a19d86ef979e6fe492af9075eafa02c19bccf79474a3cbb799832b1
SHA512

0c4bb4a8131e55ee3cffb6780b3b0298f18cc402657391b354ee22965bf14228dca4bc6da2b89e4b57c4c1f5c055ceb0999abb2d3a5b973d042ca0919057387d
SSDEEP

3072:LrS4naNLUTW+EsD0p+Tn3K8EksBzl1SYvWEm6uPcAoxkmJvDo+uWSQwBAovFwK+:FnaNkh0pY3Kl76SEpPextYRAsFr+zqH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2060	1892	rundll32.exe	90
PID 1892 wrote to memory of 2060	1892	rundll32.exe	90
PID 1892 wrote to memory of 2060	1892	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71998ae907f87e6a3fab5025e70a8b85.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71998ae907f87e6a3fab5025e70a8b85.dll,#1
  2⤵
  PID:2060