4df03a4fecfdb9aaa8dc9652f886e0f4aaea32d10e35d258c2bef513eb97da74

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 06:04

Target

7c5695092b10c02007fc5407cf245501.dll
Size

11KB
MD5

7c5695092b10c02007fc5407cf245501
SHA1

0b8bfd5b2e30564a81cf42caa71e956be1ef2841
SHA256

4df03a4fecfdb9aaa8dc9652f886e0f4aaea32d10e35d258c2bef513eb97da74
SHA512

c102f235f8fb9386b67c58b9c708771cfbc18b32a91d10b0102e1f0138361f92b52567a34e8c0b4e915aa11bf7fee2e44064ad964b39b7dcef8e63f1152e5143
SSDEEP

192:wyofla5f9UcsTzm+7ymPuEIG2ttJLhmanSYNhtofP:Rofla5lUcgzmmpPJIGMxwhCr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 2144	3380	rundll32.exe	16
PID 3380 wrote to memory of 2144	3380	rundll32.exe	16
PID 3380 wrote to memory of 2144	3380	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c5695092b10c02007fc5407cf245501.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c5695092b10c02007fc5407cf245501.dll,#1
  2⤵
  PID:2144