77131cc9b084d13bbb26afc414f3b08262145a9125d680bc824757e62d00e97c

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 09:58

Target

77131cc9b084d13bbb26afc414f3b08262145a9125d680bc824757e62d00e97c.dll
Size

1.0MB
MD5

a506809eb747ede6a7c9c7ba3b3f481c
SHA1

4c2120bd9480c049c3b3e7e41460a365da1584d3
SHA256

77131cc9b084d13bbb26afc414f3b08262145a9125d680bc824757e62d00e97c
SHA512

f1c9b01c62f882cad1eabeaec199d337e4191fc58a228ba67cf4177eecfba125397393297d2b19b9a9141abb1b219966401db23e6160ac09dee8b7b291313a85
SSDEEP

24576:I+RdvjIq4ZCWQuTs54Qbz27jlMS2Nv+4BT8+uLU:7DI2zAjlKXT3d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3548	4924	rundll32.exe	87
PID 4924 wrote to memory of 3548	4924	rundll32.exe	87
PID 4924 wrote to memory of 3548	4924	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77131cc9b084d13bbb26afc414f3b08262145a9125d680bc824757e62d00e97c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77131cc9b084d13bbb26afc414f3b08262145a9125d680bc824757e62d00e97c.dll,#1
  2⤵
  PID:3548