692ebdf827b07301d0a2c2271ca14264d0a3abb8a36fb367508e45185165e78e

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 03:46

Target

79316135772bebcae9f5f783d3dad389.dll
Size

59KB
MD5

79316135772bebcae9f5f783d3dad389
SHA1

cabcba50de3287f19e113ca86334e5ae1596f0c7
SHA256

692ebdf827b07301d0a2c2271ca14264d0a3abb8a36fb367508e45185165e78e
SHA512

3cbd5f123f95e6e6bc5c5e2426e7df7bca2c68c63c9989b91655f94d1103fbcd7a49e5d56869537d5996511d657e596d271a511c6333bf44526e0c7c199f0ff6
SSDEEP

768:VoetKTxv2paOxslcU0GcnyiguH/HQ+r/VB/qYmdOjXGR/1E+lVzq7I:iM+o0eslcBGc9HLxlqzYwRlVO7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1960	820	rundll32.exe	86
PID 820 wrote to memory of 1960	820	rundll32.exe	86
PID 820 wrote to memory of 1960	820	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79316135772bebcae9f5f783d3dad389.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79316135772bebcae9f5f783d3dad389.dll,#1
  2⤵
  PID:1960