2fa0402b5153bfca7b937b5edd201124e9152236845f643c35c27ab42f2e1abf

Analysis

max time kernel
138s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 21:54

Target

2fa0402b5153bfca7b937b5edd201124e9152236845f643c35c27ab42f2e1abf.dll
Size

981KB
MD5

66ccab04fe493082ffc853876c88395d
SHA1

aededefd56b55280f4cfee002c3b172ac378911a
SHA256

2fa0402b5153bfca7b937b5edd201124e9152236845f643c35c27ab42f2e1abf
SHA512

7747c93d8d36c24a561e6d0237ace1dface20e9a7db812e4a3b00bdc51550e1fb831782c447f5c12f50ec5a3b33c6dcd65b7bf488aa7ad590a2fb09c28fbf526
SSDEEP

24576:VX2XV7pJo6cMHEM1W94jKcRvoXiA5TRR+W:VXccNM1j2dt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1392	4572	rundll32.exe	83
PID 4572 wrote to memory of 1392	4572	rundll32.exe	83
PID 4572 wrote to memory of 1392	4572	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa0402b5153bfca7b937b5edd201124e9152236845f643c35c27ab42f2e1abf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa0402b5153bfca7b937b5edd201124e9152236845f643c35c27ab42f2e1abf.dll,#1
  2⤵
  PID:1392