7624f812abce1dc131bea9ffe3dee78aec782c633d93e494829a7bbe8f299789

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 00:39

Target

bd378c48bd1f02cdadd7e7fc3a96fa12.dll
Size

43KB
MD5

bd378c48bd1f02cdadd7e7fc3a96fa12
SHA1

977ed375a25a85017c01c553170411a41d111e55
SHA256

7624f812abce1dc131bea9ffe3dee78aec782c633d93e494829a7bbe8f299789
SHA512

5f8015ac8f3bac1e92350932ecb08dee2dad37e918bd8868b1c82b4ff5e7ac4fc7fb72d1a0630ca0dd15d80500f9718aa03da9b74cb68b6bee6f15bde955da8f
SSDEEP

768:94cNvJ4/acva8ibGxnfGGfcGffJdJUd2dbdSdJOCdhdJJdJIdJm:9J34/acAGhuGkGVe/lom

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 532	1344	rundll32.exe	89
PID 1344 wrote to memory of 532	1344	rundll32.exe	89
PID 1344 wrote to memory of 532	1344	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd378c48bd1f02cdadd7e7fc3a96fa12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd378c48bd1f02cdadd7e7fc3a96fa12.dll,#1
  2⤵
  PID:532

memory/532-0-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download