dbb67524b25eb5fe9f96dffc84f1bddb99f444dcbb993899df0100a4e422f75d

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 01:42

Target

7e8b4aaadd6223a61a254581726b80ee.dll
Size

18KB
MD5

7e8b4aaadd6223a61a254581726b80ee
SHA1

baa7173f332254a8d4a602d0d2a736d924a8da08
SHA256

dbb67524b25eb5fe9f96dffc84f1bddb99f444dcbb993899df0100a4e422f75d
SHA512

eb2de40356d2046da44bec78a957872b704467cae4853f6d6829cce0f5e2977a132244dc6b4b29dee49f66307b6ac3be124d54db4a33bd573b2cd38740afeb3e
SSDEEP

384:1CgPU85+fZA0srLBTQ6ObER3HzlqFYQfs96/dXcXRuCtpN:1e8p0uVTYwxRqF46/dXcYCtH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1140	4064	rundll32.exe	84
PID 4064 wrote to memory of 1140	4064	rundll32.exe	84
PID 4064 wrote to memory of 1140	4064	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e8b4aaadd6223a61a254581726b80ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e8b4aaadd6223a61a254581726b80ee.dll,#1
  2⤵
  PID:1140

memory/1140-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download