d468278a478d44a2980a83075ed96e1487834e93e525ed1cb48caed44466b66e

Analysis

max time kernel
94s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 07:17

Target

a331541592e6905ddb42aa364a6a09ab.dll
Size

28KB
MD5

a331541592e6905ddb42aa364a6a09ab
SHA1

2e5936cb5cd8ec14149ab572baa311b93af975ca
SHA256

d468278a478d44a2980a83075ed96e1487834e93e525ed1cb48caed44466b66e
SHA512

52b40cefd01b42ea1d97ef3939aff75f4ab7a6ce0ad6f904c830279c32acbf7c254cf112f214a77a9dbb8124fa457bbca656448107d84d7518a7f921a1f0c75f
SSDEEP

384:EB3nDlZwuOIEuHtPsY2I4YQsJixGAXMepct5mA2Wok:EB3nD7quNPsA4YNJiNXzat5ml

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 1104	4040	rundll32.exe	87
PID 4040 wrote to memory of 1104	4040	rundll32.exe	87
PID 4040 wrote to memory of 1104	4040	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a331541592e6905ddb42aa364a6a09ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a331541592e6905ddb42aa364a6a09ab.dll,#1
  2⤵
  PID:1104