d4f1f1d98b8d4a43d293bdb60b155593b7724dd7a0ce4a41801f99a2946ea0eb

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 16:21

Target

8f9be3a9aa012d30e99e2dd3d561e08f.dll
Size

35KB
MD5

8f9be3a9aa012d30e99e2dd3d561e08f
SHA1

d836ceb60c4d4aded3c8b25123a334c315e75c19
SHA256

d4f1f1d98b8d4a43d293bdb60b155593b7724dd7a0ce4a41801f99a2946ea0eb
SHA512

07d9dbea7bdf06149c504b9d633263bcec953dc94477b454562a1cbce1c7eb5c0b73fad3385489a1bafb6d4e8c1f0b0286cc70482afca2343628247fb639ca0a
SSDEEP

768:3Soa2JuBZZvylxA2URW5ny2c8SLZBKSSpRx583srZe4:I2AZFexAZWzS9BKXpmcrZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3740	2652	rundll32.exe	85
PID 2652 wrote to memory of 3740	2652	rundll32.exe	85
PID 2652 wrote to memory of 3740	2652	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f9be3a9aa012d30e99e2dd3d561e08f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f9be3a9aa012d30e99e2dd3d561e08f.dll,#1
  2⤵
  PID:3740

memory/3740-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/3740-1-0x0000000002380000-0x00000000023B2000-memory.dmp

Filesize
200KB

Download