4b2ad7825e9f0b67a97088f09fcc2d62c18b0130122045a96b95a30ac5b27aa0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:51

Target

edpauditapi.dll
Size

102KB
MD5

49a900fc7414703979b86bd7c2b5ed7a
SHA1

9c69c5218ce483a6f007b9a743e2aca02eb9e669
SHA256

4b2ad7825e9f0b67a97088f09fcc2d62c18b0130122045a96b95a30ac5b27aa0
SHA512

134aa709386031bdf78367b37479386c45858f24d28db6c11f104505e713172e48eb8eb2a06bda704ce66df9acd184ba085f085497b04605ec2418c5aa7d62eb
SSDEEP

1536:Hcz5D+cq3DfQDvm4YqvbIMgdDNmPGcI7OBBYlR1znbkJKKQ+AjKpWRkx:25+FDfQLPvvbTONEI7OB27znbFKpAjV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1596	1984	rundll32.exe	82
PID 1984 wrote to memory of 1596	1984	rundll32.exe	82
PID 1984 wrote to memory of 1596	1984	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\edpauditapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\edpauditapi.dll,#1
  2⤵
  PID:1596