1b3116cec1a604d095a3258cb63e3276b1e4e359cce00210d7f67bc8efb31d84

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 01:49

Target

7e8fe29a1e36bef4c9d931ba9364729c.dll
Size

84KB
MD5

7e8fe29a1e36bef4c9d931ba9364729c
SHA1

68ac776da49eadfc4e86388fe83999429359486b
SHA256

1b3116cec1a604d095a3258cb63e3276b1e4e359cce00210d7f67bc8efb31d84
SHA512

63391e1a4daf93d358f91216873e0d46d5fb1b4c2c7a4a548cf1bfee9b94a6102c3789e17f72779de461dec3bdc33d99bb221d570c0f9e61fb3aa3e082ea06e0
SSDEEP

1536:6IRzan4ZNxzxRWlqAP3LhlYbqRzcDrenLN5Xwll6bUIKwBeYL2:5Rw4ZNxzDU39WbqJcv8TXBgVwB5L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3496	5092	rundll32.exe	84
PID 5092 wrote to memory of 3496	5092	rundll32.exe	84
PID 5092 wrote to memory of 3496	5092	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e8fe29a1e36bef4c9d931ba9364729c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e8fe29a1e36bef4c9d931ba9364729c.dll,#1
  2⤵
  PID:3496

memory/3496-0-0x0000000001260000-0x0000000001269000-memory.dmp

Filesize
36KB

Download