3c77a3cc7e575e8050f1d308c98c0978aa4e5809d635e38728a97e9d13aecfd1

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 20:52

Target

3c77a3cc7e575e8050f1d308c98c0978aa4e5809d635e38728a97e9d13aecfd1.dll
Size

81KB
MD5

4b00d2d815f39ff615a5fe25853c67bc
SHA1

e2948fccbfd772675c1ccbc23872187bf8c4222f
SHA256

3c77a3cc7e575e8050f1d308c98c0978aa4e5809d635e38728a97e9d13aecfd1
SHA512

b0a023c75f22ed1d0383d98faccd1be3a9d152892e2beaaa4d1512a4642f9978b9240b612fc3da030861f4fbbbcc0a72509ec95bad9d93e0a609b8a18702239e
SSDEEP

1536:QByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8WV:Nv4JKXTx71wnArSsXFpeXq8WV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 888	5112	rundll32.exe	85
PID 5112 wrote to memory of 888	5112	rundll32.exe	85
PID 5112 wrote to memory of 888	5112	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c77a3cc7e575e8050f1d308c98c0978aa4e5809d635e38728a97e9d13aecfd1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c77a3cc7e575e8050f1d308c98c0978aa4e5809d635e38728a97e9d13aecfd1.dll,#1
  2⤵
  PID:888