014614e6650f00448b18b594013d532043165806280ac04e0e1aab9c9d7d8ad3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:57

Target
Client/NoClose.dll
Size 137KB
Sample240517-ba7q8aab65
SHA256 854583987aff2aa834b176be668d542b68884a061af00512cdcba40687ba98f7
MD5 162ad77a85ccc8d3fb00cc81e09e2b1e
SHA1 e6d6654e5c27b03c29b318fb390a6de839190eb7
SHA512 2336bf9045c395c9611ef13852f5b1390e983e30377eea9259845a84a76ec89fb9e8ff4f00c95920a241cfa7d8f7a52eae8fa20e5a14fd65958b660fa703d058
SSDEEP 1536:TnerqOEZk5cKcA24FxcT7+WhaWIeiq+EUkfopPYNpMW2IcgY8OicIU6RbpXfUfeT:sLcKsjyEInjRBfbIjxM6Rafq19R9
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 4536	348	rundll32.exe	84
PID 348 wrote to memory of 4536	348	rundll32.exe	84
PID 348 wrote to memory of 4536	348	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\NoClose.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\NoClose.dll,#1
  2⤵
  PID:4536