f2e911023be74260f9f9f056b6cc05c1b362534e54cd081d82bc9c806fe8fcd0

Analysis

max time kernel
132s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 10:14

Target

f2e911023be74260f9f9f056b6cc05c1b362534e54cd081d82bc9c806fe8fcd0.dll
Size

81KB
MD5

0f751772818b62372adbbccd35f21eb7
SHA1

329acd996630ab97797269ec382df3e3ea05540b
SHA256

f2e911023be74260f9f9f056b6cc05c1b362534e54cd081d82bc9c806fe8fcd0
SHA512

6b08ce7df11b3defaba9a186e244869d3fdb711a5b0cda1d5d3c1e2871850586bacf9ecd2ccd35500f5ca7f9fa9e8ff5f17ad2fa53a02f486fa9dcd188ca987f
SSDEEP

1536:ptByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WA:p4v4JKXTx71w0ArSsXF3enq8WA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 208	4284	rundll32.exe	84
PID 4284 wrote to memory of 208	4284	rundll32.exe	84
PID 4284 wrote to memory of 208	4284	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2e911023be74260f9f9f056b6cc05c1b362534e54cd081d82bc9c806fe8fcd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2e911023be74260f9f9f056b6cc05c1b362534e54cd081d82bc9c806fe8fcd0.dll,#1
  2⤵
  PID:208