3ecc0a3851d55f47045678d3676d5b0a51cb8a0a1adb14e184d7d838404ca03c

Analysis

max time kernel
98s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 19:16

Target

21caca364a7fe7ca4557bfbcddb7a6e9.dll
Size

81KB
MD5

21caca364a7fe7ca4557bfbcddb7a6e9
SHA1

e6b3b9ff9d40f6cbdd28737d2e2323cfbb9ea7fa
SHA256

3ecc0a3851d55f47045678d3676d5b0a51cb8a0a1adb14e184d7d838404ca03c
SHA512

0abefa23578700ae16e27f99f06a79aa036a505308169721f991afec5327c7aaf40b00806d1cdd043978ae1dd87c0fe729a639ef9796943992f625f695d3b5ed
SSDEEP

1536:dc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GH:a+5oxmqAiR8+/RBkez0U+c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1740	2188	rundll32.exe	85
PID 2188 wrote to memory of 1740	2188	rundll32.exe	85
PID 2188 wrote to memory of 1740	2188	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21caca364a7fe7ca4557bfbcddb7a6e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21caca364a7fe7ca4557bfbcddb7a6e9.dll,#1
  2⤵
  PID:1740