d2a923f98882126af13521c99583c734b6818b7b515a4380fd54f2fb233d8248

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 20:15

Target

900dd5ea98920accb244626bb8e906e5.dll
Size

72KB
MD5

900dd5ea98920accb244626bb8e906e5
SHA1

abfd4a966ed7e16ab2d77a0144174f128ca86e23
SHA256

d2a923f98882126af13521c99583c734b6818b7b515a4380fd54f2fb233d8248
SHA512

b6e1c487c635aa746ee71c7a1a1655e25fde4ed2f9a6de50c3b42bed7c6cbe039ed7ccb9e1c96827601a5bd4d5099635865b0c60676dede99019e58ef980e76a
SSDEEP

768:vJM3iaqavQLJ+3YlxNPTDSDrhTM+FN46J0n39h7ASQlKlo+oSovo0oOmoyowoIui:xM3iUgNPTOn5M+FN4rJUl3HrQZELlIl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2860	4600	rundll32.exe	83
PID 4600 wrote to memory of 2860	4600	rundll32.exe	83
PID 4600 wrote to memory of 2860	4600	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\900dd5ea98920accb244626bb8e906e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\900dd5ea98920accb244626bb8e906e5.dll,#1
  2⤵
  PID:2860