d100623da94885f4080df6e61082c4ddeaca92cc1b323c6abe3d2b190b80504a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 07:22

Target

c54e39ac8f8414ccab41b9bf164752b3.dll
Size

64KB
MD5

c54e39ac8f8414ccab41b9bf164752b3
SHA1

14271b74cf026f98ad130ea3711b0774710310e2
SHA256

d100623da94885f4080df6e61082c4ddeaca92cc1b323c6abe3d2b190b80504a
SHA512

df29d3a9065073528946a43b604409ba9fa881ded5f9c3cdd287622e84c0071cd00dcf7cd119f241b8819250d473456d1617e6dae4aa4d04aa51b07da38439b2
SSDEEP

768:KHLEjXqOcy48wA+LkoqW8lyTxkw9U2p26wbzC5sdxMjiB9UQgwWHiGOs3qB:KWaC+Ltq1lyTCM8nzN4los6B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 620	4812	rundll32.exe	89
PID 4812 wrote to memory of 620	4812	rundll32.exe	89
PID 4812 wrote to memory of 620	4812	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c54e39ac8f8414ccab41b9bf164752b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c54e39ac8f8414ccab41b9bf164752b3.dll,#1
  2⤵
  PID:620