cd889930d589f49fdc710b18d2a31e3325750f044b265882b77bd71d5e632b80

Analysis

max time kernel
130s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 21:55

Target
8aa248dbf538bf24407785dbf11f39c6.dll
Size 6KB
Sample240202-1s53saahan
SHA256 cd889930d589f49fdc710b18d2a31e3325750f044b265882b77bd71d5e632b80
MD5 8aa248dbf538bf24407785dbf11f39c6
SHA1 3a0886022b7e31c35c7eca5b56fb7038683c10f4
SHA512 16f1bbeb70a98bf980e05d28ca065bfd4c314011067fb3e1dafc762f79a7e125b4642b62fae17d66f1c4338b193782ce7e1247ea6b221d64ec3459bde6a7bb7f
SSDEEP 48:6++Z5YVOeJVkrm1pwbEX7PFUE7aaO0/B+BDq9J5S1XU:6eJVkrmgbCbFUaaa/B+FqX5S1k
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4800	3444	rundll32.exe	85
PID 3444 wrote to memory of 4800	3444	rundll32.exe	85
PID 3444 wrote to memory of 4800	3444	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8aa248dbf538bf24407785dbf11f39c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8aa248dbf538bf24407785dbf11f39c6.dll,#1
  2⤵
  PID:4800