a979eeabee4ba39f340c67c5454e842ad4ef5732a06c26739288f7fb7c9a2285

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 01:34

Target
a979eeabee4ba39f340c67c5454e842ad4ef5732a06c26739288f7fb7c9a2285.dll
Size 6KB
Sample240502-bzhhmafd74
SHA256 a979eeabee4ba39f340c67c5454e842ad4ef5732a06c26739288f7fb7c9a2285
MD5 3814e35141542367152df71858dbcf66
SHA1 94f43de24424139ddce0a8234887c5d201d32259
SHA512 dedea5032a9e71ca7f39d802059e5fee46b0aee1db4aabbbddc59a7615d751b9783973c4adca7289bce2fa38d489c2bedb8d54d55822f6c69ea9ca1eb69ada6a
SSDEEP 96:DixZjmjtjd8jPjcZGR5TIqNbwHD/MnhFJ/vIPbWCUsouSE/Hzf:unSR6bgY1bwj/MjJ/wj8E/Hz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4316	2992	rundll32.exe	85
PID 2992 wrote to memory of 4316	2992	rundll32.exe	85
PID 2992 wrote to memory of 4316	2992	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a979eeabee4ba39f340c67c5454e842ad4ef5732a06c26739288f7fb7c9a2285.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a979eeabee4ba39f340c67c5454e842ad4ef5732a06c26739288f7fb7c9a2285.dll,#1
  2⤵
  PID:4316