eef55ebcebb5f68e163f5870501630a8165f9b614d3fce592b2aa9e95e064b75

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 00:15

Target

user.dll
Size

58KB
MD5

b00722fe169cd9c299ed680cf1f70f9d
SHA1

d6866e9374f6bc200b79e421b6e49d73e72494a1
SHA256

931e28058383f653f1fd61878fe9dc912e04349b3a55310640069e50f041081b
SHA512

7d6e4be30e33fced995ce38e44870e00fdcfd05f955fcbd2d90658e8d42809fa910493e1ac0839a6b20e472c4f06d7a2f70122ac586d7c71d1264c7e7bef917f
SSDEEP

768:ecFlqTwEGi1Kp/qXb1kWwltp+EIJ5yhlddtX46kWOd4i8x9TanYORx0RGKrLdxPf:rlqTwEMqRSoEIJQyvJaTyYAxr1WyR+9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2832	3600	rundll32.exe	82
PID 3600 wrote to memory of 2832	3600	rundll32.exe	82
PID 3600 wrote to memory of 2832	3600	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\user.dll,#1
  2⤵
  PID:2832