02e9c53f513e613b0c6c63cc67543f8c3a66b7f9fdc66803706b412b18bbc748

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 18:16

Target

02e9c53f513e613b0c6c63cc67543f8c3a66b7f9fdc66803706b412b18bbc748.dll
Size

15KB
MD5

ff914d40f8e8068a2e5af9f4826c98f5
SHA1

b53af399ae21c83d22e517dddd0135f7232d73f8
SHA256

02e9c53f513e613b0c6c63cc67543f8c3a66b7f9fdc66803706b412b18bbc748
SHA512

ab2cbd941a4fb7e9d13a4ab5b1c8f9d833bb8e14d959c6df981f2b21d0be21e61553a272c8e86ea289aee9eb36437f524e55f427e212e7f0d98e8d75e81e20ee
SSDEEP

192:SC0itFaWlB2SYxmJzTQsoHImVigU6d984blsckwLsBb/d6T+z9SCqGfFMKK:SCb662ZWzh3ws1Jb/KU9SCq8FMKK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2376	1696	rundll32.exe	86
PID 1696 wrote to memory of 2376	1696	rundll32.exe	86
PID 1696 wrote to memory of 2376	1696	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02e9c53f513e613b0c6c63cc67543f8c3a66b7f9fdc66803706b412b18bbc748.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02e9c53f513e613b0c6c63cc67543f8c3a66b7f9fdc66803706b412b18bbc748.dll,#1
  2⤵
  PID:2376