4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 19:23

Target

4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412.dll
Size

13KB
MD5

94a186b1e49bac642029fcba57b838bb
SHA1

2316c485944194e056dc4ee4f7fcc121f9a705c3
SHA256

4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412
SHA512

2b305fde3e5487409dd17d5f9e38b0a7579c56db7a4f5854a0c4b83f4c6f03c3f0062bca055f28ee23b0d76ffe759a187ce94a1b38d2d3f513a9267a852e25f8
SSDEEP

192:NnI+cigL7G9LQRd6fQoEYuAXGQuRtg9yUusK:JI+RgL7G9L1fQozluRtvUk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 992	1016	rundll32.exe	88
PID 1016 wrote to memory of 992	1016	rundll32.exe	88
PID 1016 wrote to memory of 992	1016	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4256e2a200829aedd95c917c4412bfb306cdff0e0444cb97b8096569ab1ac412.dll,#1
  2⤵
  PID:992