c1a3c988a2c4b6b940f11f8c536f5a6d68035d67ce63c23893097ad076aa2260

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 00:38

Target

75ed708603b277e164761d6ca4077709.dll
Size

109KB
MD5

75ed708603b277e164761d6ca4077709
SHA1

1a412482b75f5a4221ec568fb8ba7e9863137b7d
SHA256

c1a3c988a2c4b6b940f11f8c536f5a6d68035d67ce63c23893097ad076aa2260
SHA512

979358571380991c81b1a111700d555056af403881c6aa121936f6f462eb55765aa23e8d979c9bcede7cca78ad351c80d86470d8d4b5999af74879cec4e1beb8
SSDEEP

1536:FhQCx49VMzMXusqSU6Vnrp862PGadbMnJ0vNF5JSvg6iIyTnWaO5VHywSF9cxQzD:BsVSsqul8wadQ0VFi2nWa4Ib9MsW7FI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4800	1684	rundll32.exe	85
PID 1684 wrote to memory of 4800	1684	rundll32.exe	85
PID 1684 wrote to memory of 4800	1684	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75ed708603b277e164761d6ca4077709.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75ed708603b277e164761d6ca4077709.dll,#1
  2⤵
  PID:4800

memory/4800-5-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/4800-1-0x00000000025A0000-0x00000000025BE000-memory.dmp

Filesize
120KB

Download
memory/4800-0-0x0000000000CD0000-0x0000000000CDF000-memory.dmp

Filesize
60KB

Download