14510811dbc00c0c216b58cb05d797de4d66e1689e1303622558f00138329c9f

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 02:50

Target
9a90b1bf2f113304b9680bf30e4621fd.dll
Size 80KB
Sample240214-dbtbbsgd29
SHA256 14510811dbc00c0c216b58cb05d797de4d66e1689e1303622558f00138329c9f
MD5 9a90b1bf2f113304b9680bf30e4621fd
SHA1 00b23b97b2aaf27f809223cf452407651b42eb9a
SHA512 f223e0728b0c0c185018ef9ea25f94e649eb6325776ab313aa3774865e5b286ed60321507e5e7569a5ecd9303a98647f2fa0be64298e25db6768040e2c6a9fb4
SSDEEP 1536:APNwiTt9Bv8lhJFjFwa+lyMPrWo+QrIuzfpGbtcoxxBt2:GsjjOTyMPrJrI4pGbdxxBt2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 2688	3112	rundll32.exe	85
PID 3112 wrote to memory of 2688	3112	rundll32.exe	85
PID 3112 wrote to memory of 2688	3112	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a90b1bf2f113304b9680bf30e4621fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a90b1bf2f113304b9680bf30e4621fd.dll,#1
  2⤵
  PID:2688

memory/2688-0-0x0000000000D60000-0x0000000000D69000-memory.dmp

Download