ba88ef6eb92a41fc54e88883ece0a18e2fbb51ed2092c444807f1f9614410482

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 02:40

Target

ba88ef6eb92a41fc54e88883ece0a18e2fbb51ed2092c444807f1f9614410482.dll
Size

81KB
MD5

dd68c1ffa7316683a0c958d0884ef6a4
SHA1

634f00e946cb77451559003009f9ff361a74ee82
SHA256

ba88ef6eb92a41fc54e88883ece0a18e2fbb51ed2092c444807f1f9614410482
SHA512

ee884221c473c8be5f2a688534f59e51b89bd736ce8501f38b37e9a554ffca32c7b0f0c4027e34d70a5fe2c1721ca95d490346b392cc7dc7a704c7e2c506e754
SSDEEP

1536:TByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wg:iv4JKXTx71wnArSsXFpeXq8Wg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2192	3020	rundll32.exe	81
PID 3020 wrote to memory of 2192	3020	rundll32.exe	81
PID 3020 wrote to memory of 2192	3020	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba88ef6eb92a41fc54e88883ece0a18e2fbb51ed2092c444807f1f9614410482.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba88ef6eb92a41fc54e88883ece0a18e2fbb51ed2092c444807f1f9614410482.dll,#1
  2⤵
  PID:2192