020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 18:09

Target

020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll
Size

168KB
MD5

12a7dcb3056ec47f82a6571ae2f401b6
SHA1

661bd039fe812723adb21f36e582b5cf0272f3e7
SHA256

020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9
SHA512

5a21b8706372df3fc6b7bcba823b82c7ff89ad6d5f2dd51ecebf25dcd68f8ac7667f8fdd8e5c08334f1c082a3f088a8aee4050ac7aad1a9dbde7fc63beacb03c
SSDEEP

3072:mnL5U9mOXm6Tw1zwk1LFAkA1cMco9wYfScAoZ:sUHTwVwkPALHWq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 3228	3500	rundll32.exe	82
PID 3500 wrote to memory of 3228	3500	rundll32.exe	82
PID 3500 wrote to memory of 3228	3500	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll,#1
  2⤵
  PID:3228