5afb39ef06f3da17f169c87fa7c629fd14bd838fa6b08683cbee5444fddda601

Analysis

max time kernel
146s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 16:36

Target
5afb39ef06f3da17f169c87fa7c629fd14bd838fa6b08683cbee5444fddda601.dll
Size 613KB
Sample240221-t4h9tsbf48
SHA256 5afb39ef06f3da17f169c87fa7c629fd14bd838fa6b08683cbee5444fddda601
MD5 b99b7341c32116b5d6332b89adaa4614
SHA1 96dd3131909163819186772e9ded05a9b8331d4e
SHA512 f491fb5ec1207856a02fc53500a288137c9bccc0d4d948a8fdb485739d3acb3dfd7bab4ededa21e8b84d22cdb49be94f7106f32fab680ebf218a6a81a4b9a5f6
SSDEEP 6144:dBqrw1HNeQdmM9XNKZOOXSpmwlLESlrN25pyfnzxt4eLTECwGceibUNv/DjB8P+q:zommxZtonlrffnzxtbTjwGcej3Bhq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4004	4472	rundll32.exe	81
PID 4472 wrote to memory of 4004	4472	rundll32.exe	81
PID 4472 wrote to memory of 4004	4472	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5afb39ef06f3da17f169c87fa7c629fd14bd838fa6b08683cbee5444fddda601.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5afb39ef06f3da17f169c87fa7c629fd14bd838fa6b08683cbee5444fddda601.dll,#1
  2⤵
  PID:4004

memory/4004-0-0x0000000000A80000-0x0000000000B1F000-memory.dmp

Download