0229933d59aef3146c7fca8d4acd3de1619db791a9ad63f387c69ac6d89f7cb2

Analysis

max time kernel
135s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 19:07

Target

0229933d59aef3146c7fca8d4acd3de1619db791a9ad63f387c69ac6d89f7cb2.dll
Size

44KB
MD5

294f7beb8c2130b075a65d1e1df243f0
SHA1

2c6961e7b6bd2aea55d56febdb3523993720766a
SHA256

0229933d59aef3146c7fca8d4acd3de1619db791a9ad63f387c69ac6d89f7cb2
SHA512

f931adf31cfe555bc45a814f1bcce386181a5666bc99e60b334b68e90291b2407f809b2496b1ed40561633c6333dd006e9ce5f507c4421365d134eb04abf2940
SSDEEP

768:LuGmYY22spwsOivvkWrpDtmwxlRh0dFGrLKvLz4WsNoC+M2HFZl+NIt4nyD:PmcdVVN0dFGSz4WC7UHF2I2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4344	940	rundll32.exe	84
PID 940 wrote to memory of 4344	940	rundll32.exe	84
PID 940 wrote to memory of 4344	940	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0229933d59aef3146c7fca8d4acd3de1619db791a9ad63f387c69ac6d89f7cb2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0229933d59aef3146c7fca8d4acd3de1619db791a9ad63f387c69ac6d89f7cb2.dll,#1
  2⤵
  PID:4344