a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf

Analysis

max time kernel
133s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 01:32

Target

a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf.dll
Size

303KB
MD5

63d64e58014dec0a357a27fad75a79ed
SHA1

8e9483a9f91e1911a0db19167b7741a823da5746
SHA256

a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf
SHA512

753babe2e87418d571639ffb1935a75fd12c1e6f8ffb4e914d8bdbf7ac94c2db00ac52ddac6eb466de7d0e23a6a283aa35bf1092b9f0046214c41d352c8b2278
SSDEEP

6144:MibiBWGNdVlqXzcU0ibHozAPQqoGvRo/FkS:MibiBdLqXzl09StoH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1316	936	rundll32.exe	85
PID 936 wrote to memory of 1316	936	rundll32.exe	85
PID 936 wrote to memory of 1316	936	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf.dll,#1
  2⤵
  PID:1316