a636a22ba499261bf77b114676f49241f9c4532d586bb206db1cbddcb9c6bf8d

Analysis

max time kernel
1477s
max time network
1498s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06-03-2024 13:56

Target

$TEMP/$0.dll
Size

29KB
MD5

c3b224d15a9036805575b2ff0bcefeda
SHA1

74779ae82a97e97d770435d097821810f16c97c5
SHA256

23d8aeff49ffbac9f9490e9739e059cd7064516dbcd693fe2de77830b127ff8a
SHA512

5a5d98cc9a4aca076049340a4645879a8e4a1d2e24a672015627446d7e3729acf0b64bc8a0f702b8da735d22607fe13ba3ef6a497a57891804576899b06bb461
SSDEEP

384:XE+iXOWKqv0WEXSvQiJb7Mejv14ESgQaMOaA9qqKYu8iFz/pvow3PrCDaU2:XxspKA0ZiVfWEVUfYuhFzVowOD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 224	5104	rundll32.exe	78
PID 5104 wrote to memory of 224	5104	rundll32.exe	78
PID 5104 wrote to memory of 224	5104	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$0.dll,#1
  2⤵
  PID:224

memory/224-0-0x0000000001160000-0x0000000001170000-memory.dmp

Filesize
64KB

Download
memory/224-1-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

Filesize
64KB

Download
memory/224-2-0x0000000074C80000-0x0000000074C90000-memory.dmp

Filesize
64KB

Download
memory/224-3-0x0000000074310000-0x0000000074AC1000-memory.dmp

Filesize
7.7MB

Download
memory/224-4-0x0000000005870000-0x0000000005E16000-memory.dmp

Filesize
5.6MB

Download
memory/224-5-0x00000000053A0000-0x0000000005432000-memory.dmp

Filesize
584KB

Download
memory/224-7-0x0000000074310000-0x0000000074AC1000-memory.dmp

Filesize
7.7MB

Download