736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 02:10

Target
mineeonad.dll
Size 577KB
Sample240214-clyhcsfe95
SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
MD5 ec10d3888f7907ee3dffc5f883d84196
SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1228	2284	rundll32.exe	85
PID 2284 wrote to memory of 1228	2284	rundll32.exe	85
PID 2284 wrote to memory of 1228	2284	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mineeonad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mineeonad.dll,#1
  2⤵
  PID:1228