368bad8e955b426695f2ef051d7754b219c8c38b82d0ac850fb0413aeee641cf

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 10:21

Target

368bad8e955b426695f2ef051d7754b219c8c38b82d0ac850fb0413aeee641cf.dll
Size

36KB
MD5

699d38b3e5b7c2c6ef734f121f5df456
SHA1

37fd45a732ac09f1fddcf1ed87c9b8ab1c345ae9
SHA256

368bad8e955b426695f2ef051d7754b219c8c38b82d0ac850fb0413aeee641cf
SHA512

9ec64c7d6491f74744723667b1ee89fa20f81a98a5ee6f44d2125c01364355e7acbd4a05e433dd11f6fe155a5ac684936e138631cdbb5d31b70d5c686014092c
SSDEEP

768:C39aZ/adyHjt2hLFsTGOsk23NZuju/eEl:0+t2hLFsTGO0QuG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 4632	3160	rundll32.exe	84
PID 3160 wrote to memory of 4632	3160	rundll32.exe	84
PID 3160 wrote to memory of 4632	3160	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\368bad8e955b426695f2ef051d7754b219c8c38b82d0ac850fb0413aeee641cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\368bad8e955b426695f2ef051d7754b219c8c38b82d0ac850fb0413aeee641cf.dll,#1
  2⤵
  PID:4632