f4408c4dfbc37a768371bf4bdec5723ccfcae19a9358e384bfc8b7593dab94a5

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 04:19

Target

f4408c4dfbc37a768371bf4bdec5723ccfcae19a9358e384bfc8b7593dab94a5.dll
Size

6KB
MD5

1d375486748587cb255afb742734b6a5
SHA1

d027f489d59b03037e748ff5465f6b8c47322a26
SHA256

f4408c4dfbc37a768371bf4bdec5723ccfcae19a9358e384bfc8b7593dab94a5
SHA512

d8212ca6924093f4fab63cc77d34b68e48104b69ae3dc8580b2c8b172476e365df6d68f7122fa5dc7688eec32b0ceb47b88814c0d8615187467c165bc50857c3
SSDEEP

96:hy859x0P8MacZcLSplhk77QWboxbbZQ5J7R5hhL0lhahLTA1r:F5oLjcLSpzk77iCvnXL0zwLc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1484	888	rundll32.exe	84
PID 888 wrote to memory of 1484	888	rundll32.exe	84
PID 888 wrote to memory of 1484	888	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4408c4dfbc37a768371bf4bdec5723ccfcae19a9358e384bfc8b7593dab94a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4408c4dfbc37a768371bf4bdec5723ccfcae19a9358e384bfc8b7593dab94a5.dll,#1
  2⤵
  PID:1484