889bfab5b3e145fa605ed1922a0584b1ebaa59fc847762bc79ff047897f4ec75

Analysis

max time kernel
131s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:00

Target

889bfab5b3e145fa605ed1922a0584b1ebaa59fc847762bc79ff047897f4ec75.dll
Size

327KB
MD5

6364c630cdefbab84b0d71a62f0a5f17
SHA1

b94c18e792ab0065fb938f5d31d434230b6680cf
SHA256

889bfab5b3e145fa605ed1922a0584b1ebaa59fc847762bc79ff047897f4ec75
SHA512

e64b8da68425a595b55d014eddea525f717acc157fee3986a13add2b308bd41819e3e95ef702652a1189202ad59c84db60f02f6af999c940e1676638a1d6c303
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2996 wrote to memory of 4448	2996	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 4448	2996	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 4448	2996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\889bfab5b3e145fa605ed1922a0584b1ebaa59fc847762bc79ff047897f4ec75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\889bfab5b3e145fa605ed1922a0584b1ebaa59fc847762bc79ff047897f4ec75.dll,#1
2⤵
PID:4448