06ed93434d4b2a53458e449e43271312e238696662ad3a67b086c31c5a936f8e

Analysis

max time kernel
105s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 15:16

Target

7a9457728ebe08ee48e613dce8af93a5.dll
Size

33KB
MD5

7a9457728ebe08ee48e613dce8af93a5
SHA1

a2587b43168e11110d17003687e70f50105f0d5b
SHA256

06ed93434d4b2a53458e449e43271312e238696662ad3a67b086c31c5a936f8e
SHA512

11a77524e312e39d096799540a6fa0734bb3dbcbe73ba00c34120707432bc3f6d426d04850d43c69b8a32415713cc665c3cc4840a679138c69d26da6498a37eb
SSDEEP

768:uSn1bTS2JZHNZCyxpzm7N6X7Lfdhh5hcD/4s+pR3zmgZ:uSn1bTSypSu7LFhzC8s+pRjmO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5248	1812	rundll32.exe	85
PID 1812 wrote to memory of 5248	1812	rundll32.exe	85
PID 1812 wrote to memory of 5248	1812	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a9457728ebe08ee48e613dce8af93a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a9457728ebe08ee48e613dce8af93a5.dll,#1
  2⤵
  PID:5248