49f6cff5780295315c7dd85367ef9416a93440da3d5339d709d56a6255b2116a

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 21:34

Target

c1a8d8b41de36888af83e2a7e7812ae7.dll
Size

72KB
MD5

c1a8d8b41de36888af83e2a7e7812ae7
SHA1

57c571e0916bc11a9a81095435a7ac1e6336226d
SHA256

49f6cff5780295315c7dd85367ef9416a93440da3d5339d709d56a6255b2116a
SHA512

be700c62194800e9a959b8861646a01e71f3c3b9aaa5ba571ba6250d68a221265c2b672f23b559ba8127b031ff36758c3be26719c911b09a80e53ec007245232
SSDEEP

1536:5Tb619lyg9Oqo0zIALHO++4GCr/CMenLUjlCQtECxbi8LUtmr6:JFAMgfxbr/xdtzxJUtU6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1588	1496	rundll32.exe	88
PID 1496 wrote to memory of 1588	1496	rundll32.exe	88
PID 1496 wrote to memory of 1588	1496	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1a8d8b41de36888af83e2a7e7812ae7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1a8d8b41de36888af83e2a7e7812ae7.dll,#1
  2⤵
  PID:1588

memory/1588-0-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download