be2c1e8b419d8f8e85fb7a4a4e6a6c908244ee9520f9657da932c23cf7ed4ddb

Analysis

max time kernel
147s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 15:37

Target

$TEMP/$0.dll
Size

29KB
MD5

c3b224d15a9036805575b2ff0bcefeda
SHA1

74779ae82a97e97d770435d097821810f16c97c5
SHA256

23d8aeff49ffbac9f9490e9739e059cd7064516dbcd693fe2de77830b127ff8a
SHA512

5a5d98cc9a4aca076049340a4645879a8e4a1d2e24a672015627446d7e3729acf0b64bc8a0f702b8da735d22607fe13ba3ef6a497a57891804576899b06bb461
SSDEEP

384:XE+iXOWKqv0WEXSvQiJb7Mejv14ESgQaMOaA9qqKYu8iFz/pvow3PrCDaU2:XxspKA0ZiVfWEVUfYuhFzVowOD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 3528	1592	rundll32.exe	85
PID 1592 wrote to memory of 3528	1592	rundll32.exe	85
PID 1592 wrote to memory of 3528	1592	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$0.dll,#1
  2⤵
  PID:3528

memory/3528-0-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/3528-1-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/3528-3-0x0000000074F60000-0x0000000075710000-memory.dmp

Filesize
7.7MB

Download
memory/3528-2-0x00000000758A0000-0x00000000758B0000-memory.dmp

Filesize
64KB

Download
memory/3528-4-0x0000000005320000-0x00000000058C4000-memory.dmp

Filesize
5.6MB

Download
memory/3528-5-0x0000000002970000-0x0000000002A02000-memory.dmp

Filesize
584KB

Download
memory/3528-7-0x0000000074F60000-0x0000000075710000-memory.dmp

Filesize
7.7MB

Download