1124b4d8cedcfeba2c6f6874a9fd2ceed99ed62f19950e423be22f291af47862

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 18:37

Target

1124b4d8cedcfeba2c6f6874a9fd2ceed99ed62f19950e423be22f291af47862.dll
Size

6KB
MD5

10baeaf9c07b992dffb5b4c059bcbb36
SHA1

0f4bf0ef54e6fd57ae644551d75f4d2b896f35db
SHA256

1124b4d8cedcfeba2c6f6874a9fd2ceed99ed62f19950e423be22f291af47862
SHA512

463183bd91ed36c9e4ab94a60c0ccddbc634e5a7a67965c319b74500b990f70d4d57f2180b7a179f327cbc55226b36cb494b5100e529117faf794c7f1dc0816a
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0rB+BDq9J5SC:8qtV0HAr4OB+FqX5SC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4808	2816	rundll32.exe	85
PID 2816 wrote to memory of 4808	2816	rundll32.exe	85
PID 2816 wrote to memory of 4808	2816	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1124b4d8cedcfeba2c6f6874a9fd2ceed99ed62f19950e423be22f291af47862.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1124b4d8cedcfeba2c6f6874a9fd2ceed99ed62f19950e423be22f291af47862.dll,#1
  2⤵
  PID:4808