ce91443c7646815b04022a1f6a4b1df808b049779a9efd0b9bfe6d8b52e1a9c8

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:07

Target

ce91443c7646815b04022a1f6a4b1df808b049779a9efd0b9bfe6d8b52e1a9c8.dll
Size

164KB
MD5

af0babfb0bac3786bbb0a30876175bf3
SHA1

2fd58abb18892b22107cac45ae71137382cd83a4
SHA256

ce91443c7646815b04022a1f6a4b1df808b049779a9efd0b9bfe6d8b52e1a9c8
SHA512

40b72f8c91691f5effdca82513b4df13b428ce2b175bb97819453c687f5892cae3b9eb61ebf16acefb335d27167972865fb5daf91013963b2dd3cb10d9974d15
SSDEEP

3072:tVBiBv1uoAjVV0RrfGlNATK7kNbPd1D/1Zddm7lF:fBudAZVyGfAGYNPTJZddmb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 1920	4072	rundll32.exe	85
PID 4072 wrote to memory of 1920	4072	rundll32.exe	85
PID 4072 wrote to memory of 1920	4072	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce91443c7646815b04022a1f6a4b1df808b049779a9efd0b9bfe6d8b52e1a9c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce91443c7646815b04022a1f6a4b1df808b049779a9efd0b9bfe6d8b52e1a9c8.dll,#1
  2⤵
  PID:1920