b138c90641b1f48232997b763cd7188ffb1d58d13e347d70662ff0a5f5571990

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 10:43

Target

b138c90641b1f48232997b763cd7188ffb1d58d13e347d70662ff0a5f5571990.dll
Size

132KB
MD5

57de173225021dc0efcd3c32891a54f9
SHA1

646200d075bc7a9cb478a75d1d31cc232a678a1f
SHA256

b138c90641b1f48232997b763cd7188ffb1d58d13e347d70662ff0a5f5571990
SHA512

5b2af212e5cc911093ae6466fa3ca005626528b1f4eaea78b9ace86e09e4853cc32e3175e45489aab3d95ae8a83628beae0bbdb3a471867e3865f4e4566d86a1
SSDEEP

1536:gJRbAfixWg+xjaweR6IO2fJlRFkhb3GHFAc3PGE4YyaF5+5lUBLM7BkaxR7BkA7j:g/2MH+f7SVlLeE4YyaF5+5lUql/lb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 4296	3876	rundll32.exe	78
PID 3876 wrote to memory of 4296	3876	rundll32.exe	78
PID 3876 wrote to memory of 4296	3876	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b138c90641b1f48232997b763cd7188ffb1d58d13e347d70662ff0a5f5571990.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b138c90641b1f48232997b763cd7188ffb1d58d13e347d70662ff0a5f5571990.dll,#1
  2⤵
  PID:4296