b90c36718ecebf3d4ffd42a0e12f238888a31b5a6488553ffedb7ec3a5f1accb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 12:36

Target
de06f78decbc3e566d830043528ecf1f.dll
Size 24KB
Sample240325-ps2jtaaf3y
SHA256 b90c36718ecebf3d4ffd42a0e12f238888a31b5a6488553ffedb7ec3a5f1accb
MD5 de06f78decbc3e566d830043528ecf1f
SHA1 75d622e0d54f1ef466bb8b2c49140ab7ed64bff5
SHA512 251e6ba705006a7074c6d6284cf35027926eb4d7e5d696e9ac6793a6922fb9ddc14729378d21c7f5262b0802737e4eeac9b148afec7c848e8e9cf67fef5dba31
SSDEEP 192:ksNGS9RWanc9Lht82SrBOUzk9m4VM8GjFVemPej8V1TqMXkp:kcG8W59LhtEQA/4O82FV9PS8Vkwkp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4692	5116	rundll32.exe	88
PID 5116 wrote to memory of 4692	5116	rundll32.exe	88
PID 5116 wrote to memory of 4692	5116	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de06f78decbc3e566d830043528ecf1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de06f78decbc3e566d830043528ecf1f.dll,#1
  2⤵
  PID:4692