95583fa95b89331414978c99a6e08469d6c202f29745b7113b86c3a4d7a4b9c4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:32

Target

95583fa95b89331414978c99a6e08469d6c202f29745b7113b86c3a4d7a4b9c4.dll
Size

6KB
MD5

0e3f39a83f6934212243c8681a7831ff
SHA1

83cd0844594b31579afa1085ad496ec58dfa848d
SHA256

95583fa95b89331414978c99a6e08469d6c202f29745b7113b86c3a4d7a4b9c4
SHA512

029b158964edda46cc86be94e88970881ce886a3247e2fdaefdfe903870ee3a8ec527b495a6b23bfb122b6c6afe461019866b836aec95a646c1dfd4f9a32f374
SSDEEP

48:SfIBj0W6/aGxkaklS4rklStklSd8klSPklSTIZGifi5qwlGsPvw4p5hoZO0TdAWJ:DixZjmjtjd8jPjcZGR5TI2CZytMfS5N

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2492 wrote to memory of 4564	2492	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 4564	2492	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 4564	2492	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95583fa95b89331414978c99a6e08469d6c202f29745b7113b86c3a4d7a4b9c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95583fa95b89331414978c99a6e08469d6c202f29745b7113b86c3a4d7a4b9c4.dll,#1
2⤵
PID:4564