1289e00152ee4449fc166026d2f7a67478dff933561e0a39c88ac401763c7e65

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 01:02

Target

DirectWriteForwarder.dll
Size

468KB
MD5

a36d73301123334adc95e034b327daad
SHA1

cb4bd930cbe2c930d665dd4467e8b88815de8c1d
SHA256

440c95dcdbe402d843095649773d1fc6da5d035802dd540ce29c71bc915d433b
SHA512

438abf9aa1c00bf1f3e9ec7e9ac6bf5d89c492d68301044ba7fb205d3c5d34aae4940893eff721b91696de4c782a8a3558cdb39955943e350361639893ef3393
SSDEEP

6144:eTDF2kb51CJfk7g9wSikA+6Bl5f7d5rBkwLENfTKSr1dDqY9DGKwHrD:oDVbK6kA+6B/d5rlUfTrDT6KwHr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4800	2808	rundll32.exe	87
PID 2808 wrote to memory of 4800	2808	rundll32.exe	87
PID 2808 wrote to memory of 4800	2808	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DirectWriteForwarder.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DirectWriteForwarder.dll,#1
  2⤵
  PID:4800