e484d956f701e5b5b6979cacaa62e5b1d476eeb06836ed8e75b9e72f17cd426f

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 02:19

Target
9a818a27de232f4e643e4fcd25a35511.dll
Size 116KB
Sample240214-cr79rafg45
SHA256 e484d956f701e5b5b6979cacaa62e5b1d476eeb06836ed8e75b9e72f17cd426f
MD5 9a818a27de232f4e643e4fcd25a35511
SHA1 6c2a13ac070d3c6a1cd20d05c14add49cbc5c7a3
SHA512 40fbad08c14e5d266f618d3eeac05402db2716955503d6d28400b1e00f3d14e73320c4d64d888c2843c87e9db52a3e4b8028771153505969b53772ac65075846
SSDEEP 1536:ZBN53h9CP8DX9QXPnoT/gcm6qQPz+VTowRkxuKwG0AlKMqqU+NV23S2iuqJFB:VhDXqMXzConuKwGzlKMqqDLy/FcB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3756	3312	rundll32.exe	86
PID 3312 wrote to memory of 3756	3312	rundll32.exe	86
PID 3312 wrote to memory of 3756	3312	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a818a27de232f4e643e4fcd25a35511.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a818a27de232f4e643e4fcd25a35511.dll,#1
  2⤵
  PID:3756

memory/3756-0-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

Download

memory/3756-4-0x0000000010000000-0x0000000010028000-memory.dmp

Download