e9c33d729fd1219a74d01f6e38dc91e43696c029067c9efe2b6238ca76c9a53b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 03:54

Target

e9c33d729fd1219a74d01f6e38dc91e43696c029067c9efe2b6238ca76c9a53b.dll
Size

81KB
MD5

a59305d745466358a9d48cf1f096fa8d
SHA1

17cd3fac608b06fe2cc70a7f111fe8eb3367e7b8
SHA256

e9c33d729fd1219a74d01f6e38dc91e43696c029067c9efe2b6238ca76c9a53b
SHA512

2fec3b76ab9426fcc8600ef6790c854720b68182636ad53d1fc9115298f070fce19043971a0c1a71b7a568e04976edcaac80428d1754e7238c033e952e452989
SSDEEP

1536:wByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8WQ:tv4JKXTx71wnArSsXFpeXq8WQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4748	1928	rundll32.exe	84
PID 1928 wrote to memory of 4748	1928	rundll32.exe	84
PID 1928 wrote to memory of 4748	1928	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c33d729fd1219a74d01f6e38dc91e43696c029067c9efe2b6238ca76c9a53b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c33d729fd1219a74d01f6e38dc91e43696c029067c9efe2b6238ca76c9a53b.dll,#1
  2⤵
  PID:4748