9325aa096b26e56e794f33f1e2f6acdf6b1cd256d687605a62bf8fbdbb8524f0

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 00:06

Target
9325aa096b26e56e794f33f1e2f6acdf6b1cd256d687605a62bf8fbdbb8524f0.dll
Size 81KB
Sample240511-advqdscd74
SHA256 9325aa096b26e56e794f33f1e2f6acdf6b1cd256d687605a62bf8fbdbb8524f0
MD5 9d4489338a1fc791a5a0f4d8b901c1ad
SHA1 10c83c18e702dffe294f7e6733fa125d3c087515
SHA512 b795c4bec98b46bbbbaec052029f3fe3adbcdb9d7cc7295d1a560a0fccfc43dd6df893a5b94a6041d1a7bdaafcad864bd6a7a67bbe7508368cec679e44332278
SSDEEP 1536:ftByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wi:f4v4JKXTx71w0ArSsXF3enq8Wi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4164	4080	rundll32.exe	85
PID 4080 wrote to memory of 4164	4080	rundll32.exe	85
PID 4080 wrote to memory of 4164	4080	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9325aa096b26e56e794f33f1e2f6acdf6b1cd256d687605a62bf8fbdbb8524f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9325aa096b26e56e794f33f1e2f6acdf6b1cd256d687605a62bf8fbdbb8524f0.dll,#1
  2⤵
  PID:4164