ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200

Analysis

max time kernel
66s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 15:35

Target

bin/freebl3.dll
Size

314KB
MD5

f474dd91bb12f230209ec3163ce7e6c4
SHA1

04ff682e527a1c132f73bd836b7880dfa1128528
SHA256

f63b2cab4b77ac63a1beca66872a991e1f8233f2c513d42460dbf28c733b138c
SHA512

01f1feaacda301b013f5e097fa5816b0075b7389ee0522e8fe350802093f6cdfe6ade24ff2a0350896b333e44a77901bbcead85f8cf98bfa91fb110c18adbfee
SSDEEP

6144:rYq6WFCT7yIFyGre4gqvkeZEcoE9OhFPs3ivxVu0yUzHjp9AkVliqqDL687PXGHe:r5i7JlgqvkeZEcocOADUflHXqn6sIWB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4640	1240	rundll32.exe	83
PID 1240 wrote to memory of 4640	1240	rundll32.exe	83
PID 1240 wrote to memory of 4640	1240	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\freebl3.dll,#1
  2⤵
  PID:4640