8ec4b31ee51f352b2a06434ca2909f2b7607773f0033502e23a3722c3164a4d6

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 22:47

Target

8ec4b31ee51f352b2a06434ca2909f2b7607773f0033502e23a3722c3164a4d6.dll
Size

342KB
MD5

09c67dfb39b877f8b88f76dde1c30f99
SHA1

d04c7ca22a299a87db7fb6868ff135d1b139127a
SHA256

8ec4b31ee51f352b2a06434ca2909f2b7607773f0033502e23a3722c3164a4d6
SHA512

130f329ef6a954d05c320cba135e6beecb5f6f55cc650b7c83b027a19fba5beddf1c45728d1c767196ede7c30e26532c0bee277c4453bcfeadb9e2bbd7228a67
SSDEEP

6144:zRoOpXN8bEvZehNyi5qlscXsKCkSLjn7WQDilmvWpJJvEiy:zRoOpXCjNwlscXeJikilmvYEiy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 612	3584	rundll32.exe	86
PID 3584 wrote to memory of 612	3584	rundll32.exe	86
PID 3584 wrote to memory of 612	3584	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ec4b31ee51f352b2a06434ca2909f2b7607773f0033502e23a3722c3164a4d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ec4b31ee51f352b2a06434ca2909f2b7607773f0033502e23a3722c3164a4d6.dll,#1
  2⤵
  PID:612