f45c3c3565766178738ddca84d6af2a933e535aafaf02b8de6f5e2a36929172e

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 22:23

Target

a07c9e3c4c357cc9d78c1b654e1af773.dll
Size

58KB
MD5

a07c9e3c4c357cc9d78c1b654e1af773
SHA1

713a5950cc5809790b3f37d955dc46487deb4f8f
SHA256

f45c3c3565766178738ddca84d6af2a933e535aafaf02b8de6f5e2a36929172e
SHA512

ee4283319d465a91f17529e76706fc34bb7e9d098418e951228345c0cb816e0d4205234fd41a585c83230532de1b166f9c8d2f5167db7d66f0aaaabc57f0d06d
SSDEEP

768:ROySqtmQLgywJ4r8LQUD8nLMV+9OgUkdXyCAWaarcdxKZu+jDk2i:rSqtmQLgyx8LQUwnL82UkICXkkcIkL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 2124	3520	rundll32.exe	57
PID 3520 wrote to memory of 2124	3520	rundll32.exe	57
PID 3520 wrote to memory of 2124	3520	rundll32.exe	57

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a07c9e3c4c357cc9d78c1b654e1af773.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a07c9e3c4c357cc9d78c1b654e1af773.dll,#1
  2⤵
  PID:2124