325afe5b9edf5d8ce21450c84a9010348b92d9475c9b945427e5cacce831fbc4

Analysis

max time kernel
137s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:16

Target

325afe5b9edf5d8ce21450c84a9010348b92d9475c9b945427e5cacce831fbc4.dll
Size

6KB
MD5

e000f663f72a97a9d31697124e1d4fd8
SHA1

5c2252debeeebc0c6c213708153fdee7c5096558
SHA256

325afe5b9edf5d8ce21450c84a9010348b92d9475c9b945427e5cacce831fbc4
SHA512

1f9f8617d975e8307403284bb0eb6a7909af602d73fd15a4ac13e8ac3966844c2c66fe5ea33bd6cb9e5590c1ad2478381eed1056a080fec0d11731f237d94296
SSDEEP

192:SoiS+O1wKaudtO1x6dq3w4LFpwDHCgF7+L2ceL0zLx48gAJVi:SOtLO1x6dqg4LFpwDHCgF7+LreL0zLx2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3160 wrote to memory of 3096	3160	rundll32.exe	rundll32.exe
PID 3160 wrote to memory of 3096	3160	rundll32.exe	rundll32.exe
PID 3160 wrote to memory of 3096	3160	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\325afe5b9edf5d8ce21450c84a9010348b92d9475c9b945427e5cacce831fbc4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\325afe5b9edf5d8ce21450c84a9010348b92d9475c9b945427e5cacce831fbc4.dll,#1
  2⤵
  PID:3096