bd163da1703da79d5b458f208523fdfaf569ae6d9dc88b81f1e06bda42647411

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 05:30

Target

a1104306d31dbf65098e57817cb11371.dll
Size

87KB
MD5

a1104306d31dbf65098e57817cb11371
SHA1

d380ea48a496c90be9723d82199a2f16acfb8b7e
SHA256

bd163da1703da79d5b458f208523fdfaf569ae6d9dc88b81f1e06bda42647411
SHA512

5ae7fad7fa52f5b8f5d0f11067cac5e560c8e749b9cff373d9ac49d727cfd3666a66fc32916e540009d040adc40747dd7cf496750cd1d837c3c29cfa9cd63efb
SSDEEP

1536:MhjFRudZaxh1r1S1YveRBrbS2+G61b7hzKtvg9gzcu1+LhjFRudZaxh1r1S1Yvea:SFR8aL1o1YverbSnG61b7hQg9gzP1qF7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 796	3264	rundll32.exe	87
PID 3264 wrote to memory of 796	3264	rundll32.exe	87
PID 3264 wrote to memory of 796	3264	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1104306d31dbf65098e57817cb11371.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1104306d31dbf65098e57817cb11371.dll,#1
  2⤵
  PID:796

memory/796-0-0x0000000000010000-0x0000000000024000-memory.dmp

Filesize
80KB

Download