b378c00a8d461da596c1553016b13337f6650f8f490470aaf45e7e8e40bd1215

Analysis

max time kernel
120s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 01:11

Target

b378c00a8d461da596c1553016b13337f6650f8f490470aaf45e7e8e40bd1215.dll
Size

6KB
MD5

3473636790e3265358314a24b4bdca03
SHA1

b998dacb6af29ef1af5c42c193da6f17a1e85732
SHA256

b378c00a8d461da596c1553016b13337f6650f8f490470aaf45e7e8e40bd1215
SHA512

46134f2e074b5ef33adaf00466af177bcd7ad4aafaa1c42771eb6b8fe168c35ed492eec30b1b784d4793b5905246a33314ab659347187eb1e86bbe2835e70588
SSDEEP

48:6DOdd5YVOiFVE/y/sqwokyJyi0CB+BDq9J5S9:piFVE/y6okJGB+FqX5S9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4576	2616	rundll32.exe	86
PID 2616 wrote to memory of 4576	2616	rundll32.exe	86
PID 2616 wrote to memory of 4576	2616	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b378c00a8d461da596c1553016b13337f6650f8f490470aaf45e7e8e40bd1215.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b378c00a8d461da596c1553016b13337f6650f8f490470aaf45e7e8e40bd1215.dll,#1
  2⤵
  PID:4576