781798d2f7ba61f44236ee2a3e8ea1a26ff3ba3f8abd4b78d307be2825364c23

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 17:42

Target

781798d2f7ba61f44236ee2a3e8ea1a26ff3ba3f8abd4b78d307be2825364c23.dll
Size

81KB
MD5

9c1e7a4653632e0a5efb10820bbaf907
SHA1

ca1f6ac9fad0869995b271e07bec2ee51bc42f04
SHA256

781798d2f7ba61f44236ee2a3e8ea1a26ff3ba3f8abd4b78d307be2825364c23
SHA512

1f566496b58178f505d3a869c317a730b3c08aefbaf5577248ff9dccaf4e8a27f86aadbc59777a91a8dd9f41a386a851904553f4d27b5593f2d88831ebb12bd8
SSDEEP

1536:VByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8WI:wv4JKXTx71wnArSsXFpeXq8WI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1448	4272	rundll32.exe	85
PID 4272 wrote to memory of 1448	4272	rundll32.exe	85
PID 4272 wrote to memory of 1448	4272	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\781798d2f7ba61f44236ee2a3e8ea1a26ff3ba3f8abd4b78d307be2825364c23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\781798d2f7ba61f44236ee2a3e8ea1a26ff3ba3f8abd4b78d307be2825364c23.dll,#1
  2⤵
  PID:1448