db71af3de6defd78079e2f6df4fdd4b2f514473ab470e2bb18d98143d3eeef08

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 03:38

Target
db71af3de6defd78079e2f6df4fdd4b2f514473ab470e2bb18d98143d3eeef08.dll
Size 81KB
Sample240415-d7kztsdf64
SHA256 db71af3de6defd78079e2f6df4fdd4b2f514473ab470e2bb18d98143d3eeef08
MD5 9d7ee05f595f20d820c93d4c8131ae55
SHA1 c63b05c42ac1ebd1761c17936990192feae0287c
SHA512 6a2c2c509ac6313dbda83a35b8e15b0704b1f76aff4375b64ab7867a21da8c3097377029bf1f167c3b8bed261f6f42127de6c7a5a029492786556f4e16b6d031
SSDEEP 1536:EByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wq:xv4JKXTx71wnArSsXFpeXq8Wq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 4004	3064	rundll32.exe	90
PID 3064 wrote to memory of 4004	3064	rundll32.exe	90
PID 3064 wrote to memory of 4004	3064	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db71af3de6defd78079e2f6df4fdd4b2f514473ab470e2bb18d98143d3eeef08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db71af3de6defd78079e2f6df4fdd4b2f514473ab470e2bb18d98143d3eeef08.dll,#1
  2⤵
  PID:4004