5341b3921b75549adbe59365517c30bd045e63162728d9ba48f79832fea1bea0

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 17:21

Target
DriverLib.dll
Size 22KB
Sample240124-vxb3lsecfl
SHA256 a81ea08c9952d61be170f19eb7922887ec1ec798cd43b95f4e7b5e8cdcdeaea8
MD5 ca6b745157ad28955f5a988a10cd93f5
SHA1 289d0afd961d4c579cf85aeb20961531adb31d0d
SHA512 e8aedfacf304c459a43367d706cfcfc6a740c933ce4ba4fb01cb84f125826eb7ecac093d2d99622fab410fd12e387be6293230f5c03087624e83f7fb857d83a8
SSDEEP 384:SHRajxnG7aKcPhQhXfFvxQCqsLbhrBzDQVK9zyqnV3fYJLea8oNE54XdUb+j:SHRajxnNKcP67hVT9zyqV3uLCij
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1136	340	rundll32.exe	84
PID 340 wrote to memory of 1136	340	rundll32.exe	84
PID 340 wrote to memory of 1136	340	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverLib.dll,#1
  2⤵
  PID:1136