77313a6e9d32197f51ba43c581942a4e7875284a8d9b40db290c7827d9314c00

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 07:11

Target

b41acaa77d2607c170ae65ce92e89037.dll
Size

110KB
MD5

b41acaa77d2607c170ae65ce92e89037
SHA1

6dfa04ba838bd0460c802ec9372ee0cb62257621
SHA256

77313a6e9d32197f51ba43c581942a4e7875284a8d9b40db290c7827d9314c00
SHA512

43bac4ac3fda09f8764eeb713f1cc92d31ea643b0919247a9eac1000514fc383febd01ef614decfe7b3a85ce33e6f6ea42e5398c849650152b9a25e225c7333a
SSDEEP

1536:aIXbIMIqkuvfZ/AuwTVxsKDjirfmWHfqeyqkaUiqvic8fO89:a0fxxvfGTVaCkiqRue

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 5072	3016	rundll32.exe	87
PID 3016 wrote to memory of 5072	3016	rundll32.exe	87
PID 3016 wrote to memory of 5072	3016	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b41acaa77d2607c170ae65ce92e89037.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b41acaa77d2607c170ae65ce92e89037.dll,#1
  2⤵
  PID:5072

memory/5072-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download