e07474874d3e0d86abfd99a94f3d43a8d7859a4015e8f40e4fef30175da52f10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:58

Target

89b312c81dd5d336494730d89c7784fe.dll
Size

16KB
MD5

89b312c81dd5d336494730d89c7784fe
SHA1

041a67aed2da7a3895df3742ed3f78e1ebb589fe
SHA256

e07474874d3e0d86abfd99a94f3d43a8d7859a4015e8f40e4fef30175da52f10
SHA512

55e7b47c1df31cfc054a95feaef53b69ee2ca269954176819936928f4f3d160cc806d730835efe2ba055dce3f5e56dd89e0f2273626a976d069fed53f7f4231d
SSDEEP

192:JtK5/b2O/owI0VfN1ljZqZtpnJJI0R8iyyhuUGPFKjEKyOFyBWHs4fheNb93X3PQ:JtKNb37jUZDJJx6ZVGFyBuxGnPV5rC1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3768	4896	rundll32.exe	85
PID 4896 wrote to memory of 3768	4896	rundll32.exe	85
PID 4896 wrote to memory of 3768	4896	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89b312c81dd5d336494730d89c7784fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\89b312c81dd5d336494730d89c7784fe.dll,#1
  2⤵
  PID:3768