a4b0d9a6d81baf5fa63cf7daf1f7cb180f4320027a23fa499179d26cd92bed20

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 23:33

Target

a4b0d9a6d81baf5fa63cf7daf1f7cb180f4320027a23fa499179d26cd92bed20.dll
Size

7KB
MD5

3cf3310f428493d36201ea861b9c81d3
SHA1

676e7fb2fc507dd16d1877c2fa7929d5864635de
SHA256

a4b0d9a6d81baf5fa63cf7daf1f7cb180f4320027a23fa499179d26cd92bed20
SHA512

bd5ca5c4e3261d4d9cb73b903b7a1d25742e1d8c202d203d725b5978daece47afab025aaad7c7fe7399f4a8fee52af63277ba7c45b4cf6aaac8087fc6a03a111
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWcbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPWq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3588	2264	rundll32.exe	88
PID 2264 wrote to memory of 3588	2264	rundll32.exe	88
PID 2264 wrote to memory of 3588	2264	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4b0d9a6d81baf5fa63cf7daf1f7cb180f4320027a23fa499179d26cd92bed20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4b0d9a6d81baf5fa63cf7daf1f7cb180f4320027a23fa499179d26cd92bed20.dll,#1
  2⤵
  PID:3588