90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020

Analysis

max time kernel
137s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 05:35

Target
90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020.dll
Size 54KB
Sample240229-gaapdagb22
SHA256 90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020
MD5 f58e0dfb8f915fa5ce1b7ca50c46b51b
SHA1 9acb977f13fce7ec38275887ddbbc0f42532e907
SHA512 4ebab09c4319c4604e7dad00f669e572ecf79d9db74a1a6f6ad833ea4be2ce3ead1548196a9b15a052ad006af28afa2005bd5523b8215e1f51fce9671a73580d
SSDEEP 768:rC8sPHjgxRIO5h7Ji10Ed4WKn84n2ZePq+RTdFvnM+cmVqDj64Bj:ri/Mf7oiEdXKn84n2ad/vbcmVWjXBj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3280	3244	rundll32.exe	85
PID 3244 wrote to memory of 3280	3244	rundll32.exe	85
PID 3244 wrote to memory of 3280	3244	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020.dll,#1
  2⤵
  PID:3280