4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:46

Target

4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846.dll
Size

22KB
MD5

f0b1c6cfdccece3f639a1e9db1ecd1b0
SHA1

7f786ed651b000bb03f3cc8aba52b29147ead77d
SHA256

4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846
SHA512

a45b88ee9d5e81f2916c0565cb0e16260571147e5e9392342bf867644849d3080f5d720d5708d4b255aea9f6551554f00381a2fb0fb5d3389c67fb1c3a263c9c
SSDEEP

384:hM+ciDFcYdo+dsXo8LPhdxmGsQCvrouOpv:QiD+YqYgxLpdxdTv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1420	4976	rundll32.exe	81
PID 4976 wrote to memory of 1420	4976	rundll32.exe	81
PID 4976 wrote to memory of 1420	4976	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846.dll,#1
  2⤵
  PID:1420