01b74edb3e8e4d54b8703f0ce18f1f35d137ca21e8cb22514639d6055158966d

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 06:51

Target

9689775b2540667c573e459902fd95d7.dll
Size

86KB
MD5

9689775b2540667c573e459902fd95d7
SHA1

cabc223acbf2eaaf84f8d9acaa61084b7a97881c
SHA256

01b74edb3e8e4d54b8703f0ce18f1f35d137ca21e8cb22514639d6055158966d
SHA512

b0b6896677924727dc38982623c642a7aabdc9e035ce9a933edc57b7f7e32f4ffa7dd8c2a2ca0153f98af0e36946cc23ebb37ed2c0f162229dc4391ec91c92c2
SSDEEP

1536:RTq7wQFWQSiC1zEoqhY8FIo55K4lNRaQ2OBy+f8Lsc27AnS5zlBKP9L2cNkIPp9:8wY3VKEhhvFIoDK4PRD2sl8Lsc2snS5W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2120	2616	rundll32.exe	84
PID 2616 wrote to memory of 2120	2616	rundll32.exe	84
PID 2616 wrote to memory of 2120	2616	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9689775b2540667c573e459902fd95d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9689775b2540667c573e459902fd95d7.dll,#1
  2⤵
  PID:2120