b36ce30bbfb0bd48d0f46b0aae9c98093adcf1a7c0a41939bb7bb5e6a26aa1c2

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 01:57

Target
Bin/AppModule.NamedPipes.dll
Size 24KB
Sample240214-cdh3pseb6x
SHA256 ad659c39e758cf56bd94e938a10c54e72dbbe35889ec4cbbb4ff5ade1c881fa4
MD5 7fab39723dfc14beaa18c426f06adc11
SHA1 5018fcb7cfe8328ea07d293df3b64f9539a7faa8
SHA512 9f984dcba94329750dc202008c0c7ab7b9009d03a6ae31af5a43cb1cd992189a0ba053c1e3e0c4ee78e2afcd2a23595f9f2ef82be6a6869f972dbe0c62f7619a
SSDEEP 192:ktp+u020M0i0kSupZOfws8H5ypJGJyFmhoRxhyere6lqVNHznEpe7jvd2S1VD:ktIfNM0bupIXOEJGJyFmhoAereeqvAi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2360	3556	rundll32.exe	84
PID 3556 wrote to memory of 2360	3556	rundll32.exe	84
PID 3556 wrote to memory of 2360	3556	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\AppModule.NamedPipes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\AppModule.NamedPipes.dll,#1
  2⤵
  PID:2360