1d759f09fc1ee69f942baed20786ed7c22fc8f60efd667dab67c3104f7b20a1a

Analysis

max time kernel
93s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 14:03

Target

1d759f09fc1ee69f942baed20786ed7c22fc8f60efd667dab67c3104f7b20a1a.dll
Size

2.4MB
MD5

a2f89f37982ea8fd00ca1fce457ad783
SHA1

673e64f96729b1635f50b5426dcb3d0c2c5cb6c2
SHA256

1d759f09fc1ee69f942baed20786ed7c22fc8f60efd667dab67c3104f7b20a1a
SHA512

ab3790f3bd315131a644db422cacc648de7784081e95eaddff8984d7e76f56d5b1bb9b9b7da9245aa6bcd8baabe2592b5529499073f9f0998be9e7175c1ab1c0
SSDEEP

49152:dC1g08DnlmBFjvJxHAzmb9SxgSjEem629UXhubAbtCqQGm/ThEBVhVptvZv:c2UHAzm5SxaemTbAbtNzm0fH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 3032	3648	rundll32.exe	84
PID 3648 wrote to memory of 3032	3648	rundll32.exe	84
PID 3648 wrote to memory of 3032	3648	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d759f09fc1ee69f942baed20786ed7c22fc8f60efd667dab67c3104f7b20a1a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d759f09fc1ee69f942baed20786ed7c22fc8f60efd667dab67c3104f7b20a1a.dll,#1
  2⤵
  PID:3032