1f410b89cdbf3e5a0b000bd81708839d6a06a6c1e6af6cb560ede8854a6c4664

Analysis

max time kernel
90s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 05:26

Target

98967c02969740487b5c59891189ffba.dll
Size

44KB
MD5

98967c02969740487b5c59891189ffba
SHA1

2f0014acd5531dacace84db2d356a170822e2753
SHA256

1f410b89cdbf3e5a0b000bd81708839d6a06a6c1e6af6cb560ede8854a6c4664
SHA512

8aae595b573d3c4b776fd3154cda7673952eed4a0768f4f3aef66098a1f16974ee020b096e4dc141af45df0be5124fe4e0d1e749d1a89394167b65b5acbd4e8b
SSDEEP

768:5aqcMRm3MRNtUdL8jfnMhbanF0lUSSYRt212fUrHq/wAZ7lwSwEPHoISlY:514fL8jf7nEUSXRt212MrHq/wAZ67EPo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4228	4960	rundll32.exe	15
PID 4960 wrote to memory of 4228	4960	rundll32.exe	15
PID 4960 wrote to memory of 4228	4960	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98967c02969740487b5c59891189ffba.dll,#1
1⤵
PID:4228

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98967c02969740487b5c59891189ffba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960