91e73c29ad491b015daa5ed50ecd619b5eee37620ddc07d057ab8ff4f368ec45

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 18:08

Target

91e73c29ad491b015daa5ed50ecd619b5eee37620ddc07d057ab8ff4f368ec45.dll
Size

3.0MB
MD5

2c749940d054618e1384b2f04ad412d0
SHA1

96d4c0f280b217a7badcac7d083f765ededf4d0a
SHA256

91e73c29ad491b015daa5ed50ecd619b5eee37620ddc07d057ab8ff4f368ec45
SHA512

a29ea495c7258c7f32775a090096957c7fd5c8c8baccf445acffc335b063c325d14b39eeda8f5c7c0d6ceb0cf08a67081f6b1167ab1d8fbc00449e8899b3a233
SSDEEP

49152:BURlyOFkPw/MUsVgQR65ZMB3u2SHdgWuNMrr5vyxRr2e2hL:BU7FkzUsVgQR6T2SHKWIMHFyP2es

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2892	1320	rundll32.exe	85
PID 1320 wrote to memory of 2892	1320	rundll32.exe	85
PID 1320 wrote to memory of 2892	1320	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91e73c29ad491b015daa5ed50ecd619b5eee37620ddc07d057ab8ff4f368ec45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91e73c29ad491b015daa5ed50ecd619b5eee37620ddc07d057ab8ff4f368ec45.dll,#1
  2⤵
  PID:2892