ca8371ff9101a99add5c195f8142a0a73948975090ec20c59045eff616797c3e

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 17:30

Target

9c3f9507e0bfaab31eaa93562aeb1fa8.dll
Size

41KB
MD5

9c3f9507e0bfaab31eaa93562aeb1fa8
SHA1

3eb148765d4b0b988d400e9086da367b6ad29cbd
SHA256

ca8371ff9101a99add5c195f8142a0a73948975090ec20c59045eff616797c3e
SHA512

0b64c3adc059e5fe1d00103ca8619288acb8cc7125d36cad6d7547ecd05107d8239834831bea5fa817bbecc48baac5e33246cd007d23f046988b6ea5b32c5f83
SSDEEP

768:79ASu+fPFFR+twkG2Ht7ZaWmldBbOMHnuqEXBcV5t6eDYYnXMNC6:6B+fPrQwp6tXUdBqMHnGuXt6exXMNC6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 224	2780	rundll32.exe	84
PID 2780 wrote to memory of 224	2780	rundll32.exe	84
PID 2780 wrote to memory of 224	2780	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c3f9507e0bfaab31eaa93562aeb1fa8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c3f9507e0bfaab31eaa93562aeb1fa8.dll,#1
  2⤵
  PID:224

memory/224-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download