2f4b1d3079e70b601d69e2b7ba0e40587490384a6b14867f4a2e544e3dc5f0ce

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 15:34

Target

c8fa9357d565c64ae2195e286d26a5ca.dll
Size

32KB
MD5

c8fa9357d565c64ae2195e286d26a5ca
SHA1

5ad3bee60c5cad0bbddbe7a48a581042e2df5f05
SHA256

2f4b1d3079e70b601d69e2b7ba0e40587490384a6b14867f4a2e544e3dc5f0ce
SHA512

be0cce9af9796cd72d9c8e436e82e2424304b3a7c2a75458e5eb55911468d70b104558ee90ff96b75263c05efa973ceb8947cbe252a7d45841110d77bdc97f2c
SSDEEP

384:iopf1ZC9c9ovkDnmFnK2eYpHfC78pxZs772qm+HoLq00dO0Baw7JFJ5CRkEn0C7:iUf3GvbnneYpq74s70VqboShVDMRk60K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4552	3060	rundll32.exe	87
PID 3060 wrote to memory of 4552	3060	rundll32.exe	87
PID 3060 wrote to memory of 4552	3060	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8fa9357d565c64ae2195e286d26a5ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8fa9357d565c64ae2195e286d26a5ca.dll,#1
  2⤵
  PID:4552