4dfeb022687a4079a677262368a458b588be5c27ff5cbe364c3a9eee9e017554

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 21:23

Target

4dfeb022687a4079a677262368a458b588be5c27ff5cbe364c3a9eee9e017554.dll
Size

678KB
MD5

fe7818923951a8182b2377b864a091ec
SHA1

aca35e705c38528cc353c02aac41d4e07b87d356
SHA256

4dfeb022687a4079a677262368a458b588be5c27ff5cbe364c3a9eee9e017554
SHA512

0a31f36e9eec91b0996e3462781ffbb824a41a9c34a5863ac5e76144d06ac6015cfd357362c4c10af6787ea59dfb79e83971d85b553ef271aed1747306d4baff
SSDEEP

12288:uX+dEx4n9T6OXfNKhqoymtIwWGDcmjEw7KPg7iWjClbc/5m9:rE65DNKQjmDnDkw7kgd5s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3060	4988	rundll32.exe	84
PID 4988 wrote to memory of 3060	4988	rundll32.exe	84
PID 4988 wrote to memory of 3060	4988	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dfeb022687a4079a677262368a458b588be5c27ff5cbe364c3a9eee9e017554.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dfeb022687a4079a677262368a458b588be5c27ff5cbe364c3a9eee9e017554.dll,#1
  2⤵
  PID:3060