24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 08:01

Target

24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a.dll
Size

6KB
MD5

8921554d0d0beca9ede18f4228a7f460
SHA1

054d311a79692d3adf4814325bb6e82767e47f5d
SHA256

24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a
SHA512

6c3a3dac0f21e240e82645c676ec49a5ef04e93d515e8250fb2ae2cde7e279ae0d7b41bfeee0b365960353f401826ae4f7ab08d34457eaff6648f7c7a5daa6b0
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0GB+BDq9J5SH:VDa9VUX9bQWmB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 544	4604	rundll32.exe	82
PID 4604 wrote to memory of 544	4604	rundll32.exe	82
PID 4604 wrote to memory of 544	4604	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a.dll,#1
  2⤵
  PID:544