76d37dfe26419ea5766b506bc19e9841e92484680e4c8e1c036692f56e577a43

Analysis

max time kernel
130s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:17

Target

76d37dfe26419ea5766b506bc19e9841e92484680e4c8e1c036692f56e577a43.dll
Size

329KB
MD5

3ab67c7aa6a5fd43d19b21f1a99dfd91
SHA1

40cb38b86af10ae24bb384ec8fa940dbf0ad952a
SHA256

76d37dfe26419ea5766b506bc19e9841e92484680e4c8e1c036692f56e577a43
SHA512

9f798a53106cf3ede39c319cd0f3569c1343772a4b1ddebf5b63a009897fc3fdb630866ccfdb11733ff2be215fb9e6380d4dffb4f1f487ddf3c1a62a77030a5d
SSDEEP

6144:RLmWnuNrNVUvPEmRyWHj8MVloEh5QLxCSPGIsTPNctYy6egz8zZ4SUcXgZ9oi:RLmWuNrNVUXEYDQL5JsL+2DN8F4SUy7i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3588 wrote to memory of 4136	3588	rundll32.exe	rundll32.exe
PID 3588 wrote to memory of 4136	3588	rundll32.exe	rundll32.exe
PID 3588 wrote to memory of 4136	3588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76d37dfe26419ea5766b506bc19e9841e92484680e4c8e1c036692f56e577a43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76d37dfe26419ea5766b506bc19e9841e92484680e4c8e1c036692f56e577a43.dll,#1
2⤵
PID:4136