c279d66e844cd1f7a59d082ee185f46f0bc4da82848b4388f08beeaa9bce7720

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 23:21

Target

b9eb59f94880c5eb5987430c950ac6f6.dll
Size

98KB
MD5

b9eb59f94880c5eb5987430c950ac6f6
SHA1

5230ac57cc4e0639832f41172920f3d30616738a
SHA256

c279d66e844cd1f7a59d082ee185f46f0bc4da82848b4388f08beeaa9bce7720
SHA512

770cdfa88d40d8dcc6c3d2e8b5f306a1f12654cf20794c821d8d03351b25e1b050b2220fedb7beddb844b79814ca9507d2dd36ffd85484beb52bdaa50658f243
SSDEEP

1536:FJ0cjtqTghdJEHlnRKg2cxhPfiJ8xmA/ImukHs3Z3P4ALX:xjtwCPSRKg2ih3iJ8MA/Imuk4Z3HX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4636	3200	rundll32.exe	85
PID 3200 wrote to memory of 4636	3200	rundll32.exe	85
PID 3200 wrote to memory of 4636	3200	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9eb59f94880c5eb5987430c950ac6f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9eb59f94880c5eb5987430c950ac6f6.dll,#1
  2⤵
  PID:4636