52b3a80c28a492eca1ce47570d5e443598944a050b194a5c5b46bb41457cf0a6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 14:51

Target

inject.dll
Size

20KB
MD5

ba22aa6f9c720ee25c8aa3ff54b68e01
SHA1

f1f2721afb45ab379ad1de06233ea6e7972c8af3
SHA256

59953830d6fa2d5306e0aa4a20b74b588c9179f10247f680ffba2e8bd025f49f
SHA512

7ce0fb95ff5f056415502a04e5b966c0c758b0955aef39c784459798e4ef5c3fb549efdf070df76ccbd7de25491c7ed35d50694e5fed7703e869ae08c4ace3bb
SSDEEP

384:xXuiWO48f+Z8N8p/ij7m+1I39giJbBw43rOGIfjZDMC821L/LoO2G2bDz7Wm:RF4hZ1p/ija+1ItpywSzjxMqZzoO27C

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2924	3300	rundll32.exe	86
PID 3300 wrote to memory of 2924	3300	rundll32.exe	86
PID 3300 wrote to memory of 2924	3300	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\inject.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\inject.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924