d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 01:43

Target

d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a.dll
Size

6KB
MD5

e564f814d2ea29d048e173ff4b3e5697
SHA1

c0485cabb852b483c2d3a2c101d45c6a356f84cc
SHA256

d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a
SHA512

550fbd9c2f3598e7c5cdfdf8fc25ebcfe66538f58f132faadb9465ece63805fb7894d02573a118c5cb5ecbc86d987d3a0d49d68f95caeed6aba82a0d7194fc92
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0FB+BDq9J5SH:VDa9VUX9bQWlB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1728	1528	rundll32.exe	86
PID 1528 wrote to memory of 1728	1528	rundll32.exe	86
PID 1528 wrote to memory of 1728	1528	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a.dll,#1
  2⤵
  PID:1728