55e85b8c25c73761ace8b69ed6715969a141d479dfa19ff626bb25ebe6946f31

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 17:11

Target

b9396981fd2920dcd8c7a23365c12788.dll
Size

304KB
MD5

b9396981fd2920dcd8c7a23365c12788
SHA1

dd1330a3c5b3109767ee5efd23c307ad8779242b
SHA256

55e85b8c25c73761ace8b69ed6715969a141d479dfa19ff626bb25ebe6946f31
SHA512

6f4185c8d79e25b4ecb8addb7bcfbfeb15d7d76343ae7f5cf8e1fdfb6fd8b75e4e998bfb98315c0d51c72e47ad6653feca0fc86eabb0bd406c82e433c0fc1328
SSDEEP

3072:EtR5WjfnFWIPJYWIWg2OjMLwHOiOoRaLJZWjVlrNyAsbigehzlXvrt7QCwp:XWOKFhYwuFWvrNyAsmlfVq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2884	1424	rundll32.exe	88
PID 1424 wrote to memory of 2884	1424	rundll32.exe	88
PID 1424 wrote to memory of 2884	1424	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9396981fd2920dcd8c7a23365c12788.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9396981fd2920dcd8c7a23365c12788.dll,#1
  2⤵
  PID:2884