b1f392b7a9068ed1618576f43e247c35180c3772ca0feec49f19395c0d118ce5

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 14:00

Target

9bdc96158fdb3a10341e7a9d983d1368.dll
Size

16KB
MD5

9bdc96158fdb3a10341e7a9d983d1368
SHA1

3f4f513a4225fc9012cf7ab99768c56c7ec5046e
SHA256

b1f392b7a9068ed1618576f43e247c35180c3772ca0feec49f19395c0d118ce5
SHA512

3302951b599a0621f7988ca161ba4de9cdb12139002ac8b051b2534ef100443d1ca6bc42d17f8de446e018748208625c3e42110c374cabeed55c6830974c68bd
SSDEEP

192:Dp93JA/2JsE2tW0KOM6HBeSpebs3TrJm3oN4Z0jlKbq62fIJmPY3djSl4VZ:DpcAGtWiM6BeSpd3Ttm3oN4wlvSNl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4796	3996	rundll32.exe	54
PID 3996 wrote to memory of 4796	3996	rundll32.exe	54
PID 3996 wrote to memory of 4796	3996	rundll32.exe	54

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bdc96158fdb3a10341e7a9d983d1368.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bdc96158fdb3a10341e7a9d983d1368.dll,#1
  2⤵
  PID:4796