9edcb28c29b7fb762f5153c96198c55466996c49934bc59adc2ff664887c00a6

Analysis

max time kernel
93s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 22:09

Target

87c94fa57b86f7eeb99d745803a7257e.dll
Size

7KB
MD5

87c94fa57b86f7eeb99d745803a7257e
SHA1

e23436d10f75d86418c5d513f17928eaf211201a
SHA256

9edcb28c29b7fb762f5153c96198c55466996c49934bc59adc2ff664887c00a6
SHA512

eff56c4f595fe4cf9b5e108580e39c054a13ce4bdec38c2019dcaa6dcc0ce51b32f7962fafd0d0c62f494d160de7fa5e7d9d8b603ed6fba0e639cc6d41f68c81
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW6bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPYq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 1548	4256	rundll32.exe	59
PID 4256 wrote to memory of 1548	4256	rundll32.exe	59
PID 4256 wrote to memory of 1548	4256	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\87c94fa57b86f7eeb99d745803a7257e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\87c94fa57b86f7eeb99d745803a7257e.dll,#1
  2⤵
  PID:1548