ae1b7790e33d94a76dad6bd4a2242567c0b8f5585f3bc851ac857bf954f5a0bb

Analysis

max time kernel
132s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 01:14

Target

ae1b7790e33d94a76dad6bd4a2242567c0b8f5585f3bc851ac857bf954f5a0bb.dll
Size

6KB
MD5

bb9221a685c81e3614c74b96357de885
SHA1

f121e2d3b8c70474b06ee956262d05b47c4de1ca
SHA256

ae1b7790e33d94a76dad6bd4a2242567c0b8f5585f3bc851ac857bf954f5a0bb
SHA512

2fad212c10c9258090335436dd91dc31374a04aef0fa5b2d885066cc882a21dff23e18d394631eaeefc04257398c859107e93477242d9687866cb0021d1edf6d
SSDEEP

96:DixZjmjtjd8jPjcZGR5TI7L161FEY/tJMlwBaZGvo:unSR6bgYi61iC+GQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 1032	3812	rundll32.exe	83
PID 3812 wrote to memory of 1032	3812	rundll32.exe	83
PID 3812 wrote to memory of 1032	3812	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae1b7790e33d94a76dad6bd4a2242567c0b8f5585f3bc851ac857bf954f5a0bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae1b7790e33d94a76dad6bd4a2242567c0b8f5585f3bc851ac857bf954f5a0bb.dll,#1
  2⤵
  PID:1032