139d27cb20a1b3d9a428d3cd4ccfdc74bedfc3af842791ae6a37198d37ab863d

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 12:29

Target

996e2f2c5ef24f48c3c847df9129f205.dll
Size

175KB
MD5

996e2f2c5ef24f48c3c847df9129f205
SHA1

1199a98fe20883560f42cf8ae9c5ec1bf13b1e6b
SHA256

139d27cb20a1b3d9a428d3cd4ccfdc74bedfc3af842791ae6a37198d37ab863d
SHA512

0329118a1f4d229177aa6aa94f1ebd585c96149cc4ffad072770fd4252cd208eaf72f883730bc849d300ffea519a71d453dd4a5f7d2dfed5824fd7d66417c55b
SSDEEP

3072:QkMRaAl74a92BdwTafvN2+JgpkV6sGMdMZ2mouRTvYd:ERaAx4aodwivkD8fmouRkd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 324	2468	rundll32.exe	82
PID 2468 wrote to memory of 324	2468	rundll32.exe	82
PID 2468 wrote to memory of 324	2468	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\996e2f2c5ef24f48c3c847df9129f205.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\996e2f2c5ef24f48c3c847df9129f205.dll,#1
  2⤵
  PID:324