29f5bbd2382cb7e0338c3bd1be4b0b13a396f6983183a9c5d90d1f1de447289d

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 20:31

Target

29f5bbd2382cb7e0338c3bd1be4b0b13a396f6983183a9c5d90d1f1de447289d.dll
Size

6KB
MD5

298b5b37fe9971f9ea5cb2b5cca3a824
SHA1

54ab7d2022e3cce139302d5a858685101dd8f122
SHA256

29f5bbd2382cb7e0338c3bd1be4b0b13a396f6983183a9c5d90d1f1de447289d
SHA512

7a24e32cba84586dd3b0699627c5e6d0725dcd6f51779e36cdeb74565a9263c0c3e0b5c5cf6f9c559fbb599713bc6163bc7ee0e7fda445855fbb37405fc1e2d8
SSDEEP

96:hy859x0P8MakL+IBLxXWuxL5rr9CwGXOyJmr/4carzsafeUbBWcjqkR+4Hy9ZskX:F5oLPC6dXlt9rGekgcwjqmkZy9F8Ga

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1704	4816	rundll32.exe	82
PID 4816 wrote to memory of 1704	4816	rundll32.exe	82
PID 4816 wrote to memory of 1704	4816	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29f5bbd2382cb7e0338c3bd1be4b0b13a396f6983183a9c5d90d1f1de447289d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29f5bbd2382cb7e0338c3bd1be4b0b13a396f6983183a9c5d90d1f1de447289d.dll,#1
  2⤵
  PID:1704