2042b7b8f9272a4cf7a8a90f9b41fd5b9168f40d98aae52c1bdbaa7b67f2bec1

Analysis

max time kernel
134s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 19:22

Target

2042b7b8f9272a4cf7a8a90f9b41fd5b9168f40d98aae52c1bdbaa7b67f2bec1.dll
Size

5KB
MD5

aab7259c1dd00c86195a413e0bdb5a02
SHA1

e7849fbfae762e5c16bbd44dfd9adcad430a0928
SHA256

2042b7b8f9272a4cf7a8a90f9b41fd5b9168f40d98aae52c1bdbaa7b67f2bec1
SHA512

ceb8031c83f3a68f8a988e0b1cd21d249b5cb996121788cbf35172dc77609102bf0da3111f47413269eb010396e9f484c6f385dd294f362954dbf64fddeca2d6
SSDEEP

96:hy859x0P8MaxR53znld6D3bLoJ4xDllbQ:F5oLqnldELu4xH0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1616	4316	rundll32.exe	86
PID 4316 wrote to memory of 1616	4316	rundll32.exe	86
PID 4316 wrote to memory of 1616	4316	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2042b7b8f9272a4cf7a8a90f9b41fd5b9168f40d98aae52c1bdbaa7b67f2bec1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2042b7b8f9272a4cf7a8a90f9b41fd5b9168f40d98aae52c1bdbaa7b67f2bec1.dll,#1
  2⤵
  PID:1616