cb61c3f9e9179882f3e72a6184be9e63a73c17bcee9ddb941296ab2798e0c7e6

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 14:36

Target

a217ffe773a1d201a67ee00c42dd4de5.dll
Size

110KB
MD5

a217ffe773a1d201a67ee00c42dd4de5
SHA1

25ffdfced68e9833cfc7027f84b1afd4510651de
SHA256

cb61c3f9e9179882f3e72a6184be9e63a73c17bcee9ddb941296ab2798e0c7e6
SHA512

469cf7bdb38b3ca093a606665ec7e9916e70b5458d26787a0e391a74c09f3756324abd501a5a3a9bda2d4407a75adfcccc5b4bccd44c4d701d6f3b4e59d1066f
SSDEEP

1536:l+RQvimb1Xz3AaEJw501IwcP4gEhdSrIdWYLpmu14SO:4RQtBDngw501PcAgoWYLwu14SO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2580	988	rundll32.exe	57
PID 988 wrote to memory of 2580	988	rundll32.exe	57
PID 988 wrote to memory of 2580	988	rundll32.exe	57

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a217ffe773a1d201a67ee00c42dd4de5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a217ffe773a1d201a67ee00c42dd4de5.dll,#1
  2⤵
  PID:2580

memory/2580-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download