4fa18ab20ac298630714465054620b34e448533e2aa49556bef259c88cad9558

Analysis

max time kernel
130s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:45

Target

4fa18ab20ac298630714465054620b34e448533e2aa49556bef259c88cad9558.dll
Size

81KB
MD5

c3885c71c94271eb54537be7225819b0
SHA1

7a81f06f938b27af72a3947a70a7a5e28aba2944
SHA256

4fa18ab20ac298630714465054620b34e448533e2aa49556bef259c88cad9558
SHA512

113312eab3be08f517cf40a269557b2cbd9c932b6eac7ff4e61fddcbc63e407a21a6a1652f053c062732676d7c598e517b9b6e2e0cf9c33466a5643ea9addf62
SSDEEP

1536:uByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8W9:Pv4JKXTx71wnArSsXFpeXq8W9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2988 wrote to memory of 2112	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 2112	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 2112	2988	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fa18ab20ac298630714465054620b34e448533e2aa49556bef259c88cad9558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fa18ab20ac298630714465054620b34e448533e2aa49556bef259c88cad9558.dll,#1
2⤵
PID:2112