028cd9f09c802f17ff1eb5c1dbd05cc81552e4dec7d557e288518c8b98d5549e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 20:20

Target

028cd9f09c802f17ff1eb5c1dbd05cc81552e4dec7d557e288518c8b98d5549e.dll
Size

81KB
MD5

4246cb889ec38536582692822a41aed0
SHA1

0007f0534496ef3ff39e725329c1284b2cb26435
SHA256

028cd9f09c802f17ff1eb5c1dbd05cc81552e4dec7d557e288518c8b98d5549e
SHA512

5b804d027f78b759bf217cda86a68edb44ab8c7993263c35db1392e8c80c0ccfeda431d59ff67eaffc0920a63c80e2bc845e7ea678f7bc40227e482326da2818
SSDEEP

1536:PtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wd:P4v4JKXTx71w0ArSsXF3enq8Wd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3820	3560	rundll32.exe	82
PID 3560 wrote to memory of 3820	3560	rundll32.exe	82
PID 3560 wrote to memory of 3820	3560	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\028cd9f09c802f17ff1eb5c1dbd05cc81552e4dec7d557e288518c8b98d5549e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\028cd9f09c802f17ff1eb5c1dbd05cc81552e4dec7d557e288518c8b98d5549e.dll,#1
  2⤵
  PID:3820