0f3f95c2bd0d428f2abb671baeccf59687ccd51a6258ccef6007ce2b402aaf18

Analysis

max time kernel
137s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:38

Target

f8ab1379f5443920e540194a2541df8b.dll
Size

7KB
MD5

f8ab1379f5443920e540194a2541df8b
SHA1

f7d80bb13547be70e94bc9b3ebc38f960237ffdf
SHA256

0f3f95c2bd0d428f2abb671baeccf59687ccd51a6258ccef6007ce2b402aaf18
SHA512

2f33cbaf6a6e0e41cd04325d091bdc1e5a701b6011d7ed428616322e0685710a88ff6ea59d26f3d8204b7deb8aaba7d6465028705162cabe37460a8e5d9068c0
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWLbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPpq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3888	5052	rundll32.exe	84
PID 5052 wrote to memory of 3888	5052	rundll32.exe	84
PID 5052 wrote to memory of 3888	5052	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8ab1379f5443920e540194a2541df8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8ab1379f5443920e540194a2541df8b.dll,#1
  2⤵
  PID:3888