2d97cd0ed4cbfb42fb87b621beba765ea217da5ca393ab265ea65e00a055c40d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 20:04

Target

2d97cd0ed4cbfb42fb87b621beba765ea217da5ca393ab265ea65e00a055c40d.dll
Size

244KB
MD5

a8cfa215be5dec4b3e24cb057228e91b
SHA1

c1763064b4ef35141df2b8ab0d2ad5fed35bc5e9
SHA256

2d97cd0ed4cbfb42fb87b621beba765ea217da5ca393ab265ea65e00a055c40d
SHA512

4fe054a902896719663f8ece11c1778de6e1cfdf22892b782f439026f083cb460bb65360af7f705e61378269f5a8391d1f86bb5c65eb1a5dda7830596b50a51c
SSDEEP

3072:BSc6s7kxu0FlAMpBOQ0736/h7ribAPq2BWqIQr8zi1KcvWnbShMSaP:BBgxuY/v0OdrPdWqIMD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 3456	4020	rundll32.exe	83
PID 4020 wrote to memory of 3456	4020	rundll32.exe	83
PID 4020 wrote to memory of 3456	4020	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d97cd0ed4cbfb42fb87b621beba765ea217da5ca393ab265ea65e00a055c40d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d97cd0ed4cbfb42fb87b621beba765ea217da5ca393ab265ea65e00a055c40d.dll,#1
  2⤵
  PID:3456