2b7de3a9723100f42aeebc2c4455b9502ecce0b2d4a5ceca3391af64b3e66cd8

Analysis

max time kernel
134s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 19:53

Target

2b7de3a9723100f42aeebc2c4455b9502ecce0b2d4a5ceca3391af64b3e66cd8.dll
Size

72KB
MD5

bfc19469e5029f494b9e3df2a8b99eea
SHA1

11a1ae6f7ac625bcc11335649abe10f6fe4bcc0a
SHA256

2b7de3a9723100f42aeebc2c4455b9502ecce0b2d4a5ceca3391af64b3e66cd8
SHA512

a2c2a127b293c570ee066f84f5e3c660a264b12c8ee3d9c2db091d88b842f8981591bfef90ec43ea66335ad862caab68c0dfae0d655468a444b9b949b5a1d38c
SSDEEP

768:yCJUaiGUiPwDTyHxmBUzIAzPDxewalSHn56F:JiGUi4D2H8BUxJeZ3F

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 3540	3868	rundll32.exe	85
PID 3868 wrote to memory of 3540	3868	rundll32.exe	85
PID 3868 wrote to memory of 3540	3868	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b7de3a9723100f42aeebc2c4455b9502ecce0b2d4a5ceca3391af64b3e66cd8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b7de3a9723100f42aeebc2c4455b9502ecce0b2d4a5ceca3391af64b3e66cd8.dll,#1
  2⤵
  PID:3540

memory/3540-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download