191f490818017bc826154a62e3263d07fb0fccf1c6aac45d3e0e019892cbbc31

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:07

Target

191f490818017bc826154a62e3263d07fb0fccf1c6aac45d3e0e019892cbbc31.dll
Size

395KB
MD5

577ca9d8b7f9922564495a04ac31d1d4
SHA1

26d04b05cb9b585df5ebb98b2b34c8cdda09c2cc
SHA256

191f490818017bc826154a62e3263d07fb0fccf1c6aac45d3e0e019892cbbc31
SHA512

be423004acdcaed8f4a80396dd2fcc094c008875f701676d8206d998fe98dd9b0f431c02addb83a6896d35180d84bae60c6aa9824d18c796f67eb13b59c34f73
SSDEEP

6144:XuDa9DoyzhtfsF7n7Pki9qOnJZkkgWH+mDkk/5PNJnc55+hlM32V50DErZAOQN+E:R9XN+7MKnJZ3Dewcz+Xk5DuZM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3080 wrote to memory of 4464	3080	rundll32.exe	rundll32.exe
PID 3080 wrote to memory of 4464	3080	rundll32.exe	rundll32.exe
PID 3080 wrote to memory of 4464	3080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\191f490818017bc826154a62e3263d07fb0fccf1c6aac45d3e0e019892cbbc31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\191f490818017bc826154a62e3263d07fb0fccf1c6aac45d3e0e019892cbbc31.dll,#1
  2⤵
  PID:4464