488edfa2d07fcba2550e45090e6c00f8c4006ae420bf83589da9a3063e4b863e

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 07:17

Target
be011513a58cec89d9058f6f706b2c1e.dll
Size 14KB
Sample240310-h4qs5afe91
SHA256 488edfa2d07fcba2550e45090e6c00f8c4006ae420bf83589da9a3063e4b863e
MD5 be011513a58cec89d9058f6f706b2c1e
SHA1 36413638475c966f49e6b32ddaf59016008d5881
SHA512 691bfe11530582312446481296af4ab285e19d43fa0219304d3fb295a3ca5917d45d3479472fc6928c03f422b2edd2c6833173db2310dd465d84b1413881a991
SSDEEP 384:MWWTEcWn6zRFR5BDRUY6UN7qZslS4R5MylfLwBEbN:H413V6UN7GipPpfoEh
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4268	2004	rundll32.exe	88
PID 2004 wrote to memory of 4268	2004	rundll32.exe	88
PID 2004 wrote to memory of 4268	2004	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be011513a58cec89d9058f6f706b2c1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be011513a58cec89d9058f6f706b2c1e.dll,#1
  2⤵
  PID:4268

memory/4268-0-0x0000000000A30000-0x0000000000A48000-memory.dmp

Download