16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:48

Target

16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7.dll
Size

81KB
MD5

05c3b9165a1cfb20e1b565725c4414c0
SHA1

cd844d4c7fc748b54fdd86f2f43526e0747be4f2
SHA256

16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7
SHA512

008378ccd177aabc93f159ce00db20e5bdb154d8ff2f51b3d426f9058d64027f6d73b837092f84f7085d2a3d008deae0771c780492e46ba698bfb75ef85d1e9f
SSDEEP

1536:YtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wm:Y4v4JKXTx71w0ArSsXF3enq8Wm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 760 wrote to memory of 3748	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 3748	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 3748	760	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7.dll,#1
2⤵
PID:3748