388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f

Analysis

max time kernel
129s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:51

Target

388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f.dll
Size

6KB
MD5

0e84d346df16dfa0d32fdfd8f0d5b540
SHA1

9c074776db000f018977e10384c71efa07578341
SHA256

388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f
SHA512

918483553b67afe4ef660e1c61f09d6902160b278b94113fcfd269844ed7b94d7b05a0be2b08d56b900d6507ce4572ea03891a4aa9a3d9b8aba5977ad044b5f3
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G03mB+BDq9J5S2:0QDV8FscMjsLFV3PmB+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4896 wrote to memory of 5780	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 5780	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 5780	4896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f.dll,#1
  2⤵
  PID:5780