be2c1e8b419d8f8e85fb7a4a4e6a6c908244ee9520f9657da932c23cf7ed4ddb

Analysis

max time kernel
91s
max time network
110s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20-04-2024 15:43

Target

$TEMP/$0.dll
Size

29KB
MD5

c3b224d15a9036805575b2ff0bcefeda
SHA1

74779ae82a97e97d770435d097821810f16c97c5
SHA256

23d8aeff49ffbac9f9490e9739e059cd7064516dbcd693fe2de77830b127ff8a
SHA512

5a5d98cc9a4aca076049340a4645879a8e4a1d2e24a672015627446d7e3729acf0b64bc8a0f702b8da735d22607fe13ba3ef6a497a57891804576899b06bb461
SSDEEP

384:XE+iXOWKqv0WEXSvQiJb7Mejv14ESgQaMOaA9qqKYu8iFz/pvow3PrCDaU2:XxspKA0ZiVfWEVUfYuhFzVowOD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3184 wrote to memory of 1008	3184	rundll32.exe	rundll32.exe
PID 3184 wrote to memory of 1008	3184	rundll32.exe	rundll32.exe
PID 3184 wrote to memory of 1008	3184	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$0.dll,#1
  2⤵
  PID:1008

memory/1008-0-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1008-1-0x00000000021B0000-0x00000000021C0000-memory.dmp

Filesize
64KB

Download
memory/1008-2-0x0000000074C70000-0x0000000074C80000-memory.dmp

Filesize
64KB

Download
memory/1008-3-0x0000000074300000-0x0000000074AB1000-memory.dmp

Filesize
7.7MB

Download
memory/1008-4-0x0000000004E40000-0x00000000053E6000-memory.dmp

Filesize
5.6MB

Download
memory/1008-5-0x0000000004930000-0x00000000049C2000-memory.dmp

Filesize
584KB

Download
memory/1008-7-0x0000000074300000-0x0000000074AB1000-memory.dmp

Filesize
7.7MB

Download