61c6cbc9703769407235fcca018660bad862c79c636dea651bab7adfa12270bb

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 02:33

Target

a0b8ad155e29038b9aacbd089422e766.dll
Size

209KB
MD5

a0b8ad155e29038b9aacbd089422e766
SHA1

a12be134804028cfddea6f92217f6d02a5e2a838
SHA256

61c6cbc9703769407235fcca018660bad862c79c636dea651bab7adfa12270bb
SHA512

6eebee933bded56b8a12025ec1385adf24b84a74e1ace6cf317482e17fc0c2ebd66ad28daad6d3f2895f3178d4d956fe63a6e09f1585205f7f4bde7e0c47c376
SSDEEP

3072:SwdVP0kY9mPARYwQQIRLS+CXgd0zOLBRgRjGwpZG:SuVxY99RYwqS+egd0zOLzWG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 2036	3840	rundll32.exe	85
PID 3840 wrote to memory of 2036	3840	rundll32.exe	85
PID 3840 wrote to memory of 2036	3840	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0b8ad155e29038b9aacbd089422e766.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0b8ad155e29038b9aacbd089422e766.dll,#1
  2⤵
  PID:2036

memory/2036-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download