28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 20:09

Target

28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956.dll
Size

31KB
MD5

81aba15e157845175a226611b136ee07
SHA1

6a18f8c51c772861fd9ffb59767511207b4b5a4a
SHA256

28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956
SHA512

481515e03b557b74daf888592257712c42cf8d88804cdc6001417c5245744454772ece6dd47ae196cf0098a84df3ca93aad045aa9a7dd13c33e66df1e4568979
SSDEEP

384:mbpd8ffVLqN/otX+1agZOboPIRgB+eeMU6VATveq7ELTZaz3NzpIvGD1:PqNsYYbOVATvLseD1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 1232	724	rundll32.exe	81
PID 724 wrote to memory of 1232	724	rundll32.exe	81
PID 724 wrote to memory of 1232	724	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956.dll,#1
  2⤵
  PID:1232