42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50

Analysis

max time kernel
94s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 10:14

Target

42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50.dll
Size

921KB
MD5

117d9f1422626dd8b35837a9ec6b6043
SHA1

1c5fd9ce0e62e27c0d55d31af4e5b8756f6df4bb
SHA256

42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50
SHA512

71d725591c4af89dfe72f403cdcf846f152cc5dc025a39a46aa2cda0710c224c2c88152e9b7e2620e38ba326d4d7da99f288f97c9c0cba08062d1b0d39ba9be8
SSDEEP

24576:PRx7FM7sNv+76dJLWbB7HmEArPpbZYJE7dxWy:j27sB32qtrh2sdxr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 3060	1084	rundll32.exe	88
PID 1084 wrote to memory of 3060	1084	rundll32.exe	88
PID 1084 wrote to memory of 3060	1084	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50.dll,#1
  2⤵
  PID:3060

memory/3060-0-0x00000000747E0000-0x00000000749A5000-memory.dmp

Filesize
1.8MB

Download
memory/3060-1-0x00000000747E0000-0x00000000749A5000-memory.dmp

Filesize
1.8MB

Download
memory/3060-2-0x00000000747E0000-0x00000000749A5000-memory.dmp

Filesize
1.8MB

Download
memory/3060-3-0x00000000747E0000-0x00000000749A5000-memory.dmp

Filesize
1.8MB

Download