0c45199c65af59e82a02dc8d6f19231ad27fe2f9fe28ede050ed05851278101d

Analysis

max time kernel
139s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 20:55

Target

7dfa2deefd92d2288a2b42fd7a096958.dll
Size

208KB
MD5

7dfa2deefd92d2288a2b42fd7a096958
SHA1

658f0bbe733023f78779797cdf53591c4042d57a
SHA256

0c45199c65af59e82a02dc8d6f19231ad27fe2f9fe28ede050ed05851278101d
SHA512

8505c42e616df40528d6cd9fb88f230be3168e8b1364e29f4cf6254262c253676e895cd5494d2115079ff20db975b4f0320610cb101102189c1e077c2b57ab0c
SSDEEP

1536:aNI/IJkuvfZ/AuwHb/YhXINVGnYg0cR4B+2PEiGXi/YvRdv+qJdrJKG2iE8xKlme:q0yxvfGHUhX+V292PAdG1G2MxKlmtqd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 700	4292	rundll32.exe	84
PID 4292 wrote to memory of 700	4292	rundll32.exe	84
PID 4292 wrote to memory of 700	4292	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7dfa2deefd92d2288a2b42fd7a096958.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7dfa2deefd92d2288a2b42fd7a096958.dll,#1
  2⤵
  PID:700

memory/700-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download