e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a

Analysis

max time kernel
66s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 01:39

Target

e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a.dll
Size

143KB
MD5

786756c0ea8c6b146e336f662bef1a9d
SHA1

43ebde827896e9281da7ebaf43205b8fc11fd197
SHA256

e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a
SHA512

aaaae6653e170dd81f5686097c6327c210454c6f39a1f200f648a74515744a8b21551eb01cfbcb18ea8ddca3722800f49f82183b4ea65e8921f4042d66291417
SSDEEP

3072:3GYcR19KDICARggR26KKnY2B7SAzCgCMKdYjtvKu:wfKsRKIYYuhdY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 216	4552	rundll32.exe	83
PID 4552 wrote to memory of 216	4552	rundll32.exe	83
PID 4552 wrote to memory of 216	4552	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a.dll,#1
  2⤵
  PID:216

memory/216-0-0x0000000000F60000-0x0000000000F70000-memory.dmp

Filesize
64KB

Download
memory/216-2-0x0000000074A00000-0x0000000074A2C000-memory.dmp

Filesize
176KB

Download
memory/216-1-0x0000000002A00000-0x0000000002A2C000-memory.dmp

Filesize
176KB

Download
memory/216-4-0x00000000740C0000-0x0000000074870000-memory.dmp

Filesize
7.7MB

Download
memory/216-5-0x00000000740C0000-0x0000000074870000-memory.dmp

Filesize
7.7MB

Download