40d926c02b5e98dde92b39f1b0d0c7f0cdbaf1e825b04493e021aae8429d3d61

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 15:55

Target

7aa881d8bcab5f0c67fb23f523754b96.dll
Size

28KB
MD5

7aa881d8bcab5f0c67fb23f523754b96
SHA1

ff246fd445cdc9f07f5841c91ea24c8961bb219f
SHA256

40d926c02b5e98dde92b39f1b0d0c7f0cdbaf1e825b04493e021aae8429d3d61
SHA512

3b33c8235c39ead41df374711b280ad94bd34386ac403e058eb312dff4407ec96b6b879a64e1344a44ca062a29d2ac00f4c6082e40bd8f06d4b171e3a087a3bf
SSDEEP

384:XTS3k2sc2yj/JFywdCtI1KCSR9Ah/YQ6huO012uwXpct5Br1LBMw82:XT12N/JFdCmPSX1hunMuwXat5BxLBH82

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4592	956	rundll32.exe	69
PID 956 wrote to memory of 4592	956	rundll32.exe	69
PID 956 wrote to memory of 4592	956	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7aa881d8bcab5f0c67fb23f523754b96.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7aa881d8bcab5f0c67fb23f523754b96.dll,#1
  2⤵
  PID:4592