ee99c20098af38833fdb9fbe5f259ea9ce6b066bf69a814e6d653536a65c8753

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 09:20

Target

96cfe84e41033355b016bf38e1c83603.dll
Size

756KB
MD5

96cfe84e41033355b016bf38e1c83603
SHA1

2f877921688cd801681e40aa9cb51052b56b2348
SHA256

ee99c20098af38833fdb9fbe5f259ea9ce6b066bf69a814e6d653536a65c8753
SHA512

efd986604ebb96756c6fd5a4fb50bd14512ee6773c7f288ba3418707e76b11aa4e1755afa875e7ea6f643063ec2f73ca74c2ba45b13826b399515fc608dc9250
SSDEEP

192:pPqs9lAITs65IONxoS64r8kLkpLcvAdwktGXJVqzAXXdOsoi9qNq/pH8yosZ5ZDQ:pP/P7NS46dASuMi9qNqN8yvV+5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1712	2712	rundll32.exe	30
PID 2712 wrote to memory of 1712	2712	rundll32.exe	30
PID 2712 wrote to memory of 1712	2712	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96cfe84e41033355b016bf38e1c83603.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96cfe84e41033355b016bf38e1c83603.dll,#1
  2⤵
  PID:1712

memory/1712-0-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download