92059dd58cd02822a15c2a41633b49c068b0fb8b02ebaa644ae14131684b3f27

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 08:42

Target

c2f07888983391a03dffcb1180a7897b.dll
Size

19KB
MD5

c2f07888983391a03dffcb1180a7897b
SHA1

d9451c3816b8f0cdfc9c1c1becff3ad3987b81b4
SHA256

92059dd58cd02822a15c2a41633b49c068b0fb8b02ebaa644ae14131684b3f27
SHA512

576c893441de5e154498b533f5a17665d7f89b98dba67cfb3bb4012f18aab249539d9f73fa29f40fd84827874e71772e01e715d092c1081dd7c18fc68906d5a2
SSDEEP

384:tlfsaG4rN9uegBSwRzslZvw9nOcl1M1CnuCWddPYqYEVJXWwDW:tlUadJ9UB1ReS9nplICnuC4dABeV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 4708	3268	rundll32.exe	90
PID 3268 wrote to memory of 4708	3268	rundll32.exe	90
PID 3268 wrote to memory of 4708	3268	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2f07888983391a03dffcb1180a7897b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2f07888983391a03dffcb1180a7897b.dll,#1
  2⤵
  PID:4708