221791ba4c1a4355d5ef6a3d29a5f793f1b566c997ed32dccd6aa16cdb851150

Analysis

max time kernel
137s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 08:51

Target

79cc732f3c085a3743309e6b981fec59.dll
Size

190KB
MD5

79cc732f3c085a3743309e6b981fec59
SHA1

222d91ef1cadd2a759dbb69097050112ac53a331
SHA256

221791ba4c1a4355d5ef6a3d29a5f793f1b566c997ed32dccd6aa16cdb851150
SHA512

c224b5fa3f5a7c605fe673c25ad8c188bb56896e1c6a77ca011da0849a1b7ae350db28b4bf590305c9b9f26b6737836ed9bc7eac87d85a24960f2ad06c316ed5
SSDEEP

3072:odi2vR6NOALVOWoYPNdRlKvFb+9r8Zs3V+iCdMk6LupMB4fvYS:od7vR6I7WoY34FbPdDSLu8NS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4492	2092	rundll32.exe	87
PID 2092 wrote to memory of 4492	2092	rundll32.exe	87
PID 2092 wrote to memory of 4492	2092	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79cc732f3c085a3743309e6b981fec59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79cc732f3c085a3743309e6b981fec59.dll,#1
  2⤵
  PID:4492