31220f0fa593b96ba44db779d34edc110ac14ec95ee30dfbfb2908a5150260ed

Analysis

max time kernel
129s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 20:35

Target

31220f0fa593b96ba44db779d34edc110ac14ec95ee30dfbfb2908a5150260ed.dll
Size

321KB
MD5

f55f1e137205b2c51f5a6a1021490852
SHA1

9ce1917a916904ed1e685192e2526e336a8e5eb4
SHA256

31220f0fa593b96ba44db779d34edc110ac14ec95ee30dfbfb2908a5150260ed
SHA512

8307496beaff318cc18c8c20b857d474676299fb06463659330f242ad8b4ffbceafc3d60bc330b65819b2eb41ec857c7f3a33681301acb0587c5c883f434f8d5
SSDEEP

6144:VbTNDf80CdtZEyH31OdsKxNBvFM/ncNX8Gub+BGZDum1Lk7:f80Cd8s4NBwcNX8G5gU7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1332	4740	rundll32.exe	84
PID 4740 wrote to memory of 1332	4740	rundll32.exe	84
PID 4740 wrote to memory of 1332	4740	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31220f0fa593b96ba44db779d34edc110ac14ec95ee30dfbfb2908a5150260ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31220f0fa593b96ba44db779d34edc110ac14ec95ee30dfbfb2908a5150260ed.dll,#1
  2⤵
  PID:1332