fb92448e9ca67d5fa1ef43f7840e4650bfcc1b6d92c7300ff95976aa1f6fc44b

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 04:30

Target

fb92448e9ca67d5fa1ef43f7840e4650bfcc1b6d92c7300ff95976aa1f6fc44b.dll
Size

2.2MB
MD5

b0e37ac49104283709494765b13dd372
SHA1

d9157bfbe90adab10d9d96fa14027968514ab9da
SHA256

fb92448e9ca67d5fa1ef43f7840e4650bfcc1b6d92c7300ff95976aa1f6fc44b
SHA512

9584e9beca20b79ff409c2a8148919c9ee93f33850deba7aa29982cf580b120efd0e46f4f253f2bf992bea58c242c3ce2d6def136e684498c2625860f627e518
SSDEEP

24576:hC8crUtVw+R1sO2gwxGq+H65DSRQBEiqPdS6E/pOXm4kM0dgPSkuBU/D7RFM9fWg:Ttvkg9a1S3KM0dkSku2Pf1sa4bNa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4384	2992	rundll32.exe	82
PID 2992 wrote to memory of 4384	2992	rundll32.exe	82
PID 2992 wrote to memory of 4384	2992	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb92448e9ca67d5fa1ef43f7840e4650bfcc1b6d92c7300ff95976aa1f6fc44b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb92448e9ca67d5fa1ef43f7840e4650bfcc1b6d92c7300ff95976aa1f6fc44b.dll,#1
  2⤵
  PID:4384