fdb5d5679f4e0aed81e81c3b887be20cca36b0920f7c90041608469d355a929c

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 12:39

Target

7a474d09921bd6177c64d4d5c28ede34.dll
Size

142KB
MD5

7a474d09921bd6177c64d4d5c28ede34
SHA1

e1ecc1e665daaecbf2d5d3f9872592288cbf8f8a
SHA256

fdb5d5679f4e0aed81e81c3b887be20cca36b0920f7c90041608469d355a929c
SHA512

4e692f789df298a018f823788e9db4bd7f5a40a8c0ebc0fb9917b56b9b2715c17275286ac810e05ed167524dd2597688bd4fbf901fbb0a05ac8f29aa39f0b658
SSDEEP

3072:uyeD1dXWQmsSP5IGbnbkugpr/X7/RzM1a+XuE+teP6QTATreX4Wket/lb4Z:uyeZl0IK4uiDTRzM1a+XT+tebcfQ4WRt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 1556	232	rundll32.exe	85
PID 232 wrote to memory of 1556	232	rundll32.exe	85
PID 232 wrote to memory of 1556	232	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a474d09921bd6177c64d4d5c28ede34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a474d09921bd6177c64d4d5c28ede34.dll,#1
  2⤵
  PID:1556

memory/1556-0-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download