595f4704e8faddb9a9f09ffb80dee8bad365ac66803edf4543e8f2626cb122c0

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 21:05

Target

595f4704e8faddb9a9f09ffb80dee8bad365ac66803edf4543e8f2626cb122c0.dll
Size

6KB
MD5

74ceb0eb3c945afd319ec02e94414c50
SHA1

61b1b9873460eb7e2112bd7a1847d0fda6b1640e
SHA256

595f4704e8faddb9a9f09ffb80dee8bad365ac66803edf4543e8f2626cb122c0
SHA512

197d339d8eb3ba88046d6ec89af06b918991b1757d6257ea645f6cbbd5acf8ee8eb73d0b8117b49b127889531ce09207915c7cd9d03b98e0027e9c5fdf45a1d0
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0HB+BDq9J5S2:0QDV8FscMjsLFV3PB+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 4824	3560	rundll32.exe	85
PID 3560 wrote to memory of 4824	3560	rundll32.exe	85
PID 3560 wrote to memory of 4824	3560	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\595f4704e8faddb9a9f09ffb80dee8bad365ac66803edf4543e8f2626cb122c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\595f4704e8faddb9a9f09ffb80dee8bad365ac66803edf4543e8f2626cb122c0.dll,#1
  2⤵
  PID:4824