8c41cfd39b81c91c488fe7731da2bb1ad6752009d01e5ecde9af869f98c9cd69

Analysis

max time kernel
131s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:11

Target

8c41cfd39b81c91c488fe7731da2bb1ad6752009d01e5ecde9af869f98c9cd69.dll
Size

6KB
MD5

2ac67f87cf480be74a8ceb3a283e8cf2
SHA1

45088b8aec4b6e0efa24f3c7e6296810399ff729
SHA256

8c41cfd39b81c91c488fe7731da2bb1ad6752009d01e5ecde9af869f98c9cd69
SHA512

1f82ee50f0f372ebefe164828533f655ca9c4a7053691fdb2f76209da7c49744fc7e19118abf757a72223a90b98f35963c369d30581000eb3a9421a2d366a861
SSDEEP

96:hy859x0P8Ma0DFXr2ousxwRvPvzgO/7c/t1A2t2ul4Ie20PpCW6:F5oLBb2oRxwRrT7c/nA27k2Co

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3364 wrote to memory of 2024	3364	rundll32.exe	rundll32.exe
PID 3364 wrote to memory of 2024	3364	rundll32.exe	rundll32.exe
PID 3364 wrote to memory of 2024	3364	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c41cfd39b81c91c488fe7731da2bb1ad6752009d01e5ecde9af869f98c9cd69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c41cfd39b81c91c488fe7731da2bb1ad6752009d01e5ecde9af869f98c9cd69.dll,#1
2⤵
PID:2024