2b70710cc5cce4b1d90e81557f34ca46a40c6eead225e86774666599b38f129d

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 01:01

Target

d4d0c7220d93410a53b95c9d9c3ce9ca.dll
Size

72KB
MD5

d4d0c7220d93410a53b95c9d9c3ce9ca
SHA1

5bc8eda031bbcf23631091dbe5f8980122adf984
SHA256

2b70710cc5cce4b1d90e81557f34ca46a40c6eead225e86774666599b38f129d
SHA512

4c9849f407a7610e0789153a431f85bfd8643451e688f2873dffa57f2774a911aae5b457209181653526c30cda3613e2c58eeeb7a4c11a457ee99e9c0ec2f9ac
SSDEEP

1536:wMbOW7wxmr40VBr+zTY5X7f54rOGVSITBoyRv5GzZZCm:wMbmxmrBVRkJdTBoyx0z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1052	5072	rundll32.exe	84
PID 5072 wrote to memory of 1052	5072	rundll32.exe	84
PID 5072 wrote to memory of 1052	5072	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4d0c7220d93410a53b95c9d9c3ce9ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4d0c7220d93410a53b95c9d9c3ce9ca.dll,#1
  2⤵
  PID:1052