221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 10:32

Target

221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92.dll
Size

1.4MB
MD5

e18eb3f977a53cd1aecbb06d5e007fc3
SHA1

0212eb04e9578dab964e50df6b056cd6e9c2a110
SHA256

221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92
SHA512

41e6bbc7c62a9059453f5379968c70a8fed5b6ac60bc2693f1574c8a756cc5a43d24299f8fd4a74277b75589842309b3820350bfde693a1687e1b6dd7d3a6ebe
SSDEEP

24576:2lSLiRPiZ6CC/AhTWHP1hvR+jyHvx3/nGNAKBe9M07YhSFtC7IQdxKHTtyRXeluT:uSLiRP3CC4BYvRNvx3Q6d0ho47xaiXie

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 2084	5052	rundll32.exe	86
PID 5052 wrote to memory of 2084	5052	rundll32.exe	86
PID 5052 wrote to memory of 2084	5052	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\221e8eb425440d4930863d9db326b99374959028253d68739e545123105e1a92.dll,#1
  2⤵
  PID:2084