5dae1996f6ff085109ca134a5d056a5e7d1b5ef2515d0c3e29967e4b99b57ad9

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 16:03

Target

7d65f6eef1f474a21ec34e576e149905.dll
Size

320KB
MD5

7d65f6eef1f474a21ec34e576e149905
SHA1

c827eb4cb09555303c4ff00af0ad231a05ffae42
SHA256

5dae1996f6ff085109ca134a5d056a5e7d1b5ef2515d0c3e29967e4b99b57ad9
SHA512

29fa1ecdcfd6b33b59003bc27012750d7f2642ea0767ada499885485695367dbb32563f101a9e9944c057d9e80d7118be1c75ae38f98d17cd6cff61fcadf66ae
SSDEEP

6144:/7caUycODMMScqyJNjuGZzfTYRtRDE3ABjqDPQf7rMhoHzb8MUCixk3wORy/XM3C:DUTYMUDxodyM3iaciy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4652	2684	rundll32.exe	84
PID 2684 wrote to memory of 4652	2684	rundll32.exe	84
PID 2684 wrote to memory of 4652	2684	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d65f6eef1f474a21ec34e576e149905.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d65f6eef1f474a21ec34e576e149905.dll,#1
  2⤵
  PID:4652

memory/4652-0-0x000000006DAA0000-0x000000006DAF5000-memory.dmp

Filesize
340KB

Download