92b272c8d70cb1463862bb8e2549cd0ea3cab134df4a80f0f094258e0892dc84

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:28

Target

92b272c8d70cb1463862bb8e2549cd0ea3cab134df4a80f0f094258e0892dc84.dll
Size

329KB
MD5

57ab0a5651b4be85349ab1b20a1ba5b6
SHA1

e0c2bd3808a9beaa0fdf07f564840385aaf24e4e
SHA256

92b272c8d70cb1463862bb8e2549cd0ea3cab134df4a80f0f094258e0892dc84
SHA512

5cb399961b4fe8d98d56f901eb987e0902a8d6566b824ecee9393376c8e42241840a31b388a11af97269b3991cdf46be1482e72a1e7549fcb0a9f833038eb672
SSDEEP

6144:RLmWnuNrNVUvPEmRyWHj8MVloEh5QLxCSPGIsTPNctYy6egz8zZ4SUcXgZFoi:RLmWuNrNVUXEYDQL5JsL+2DN8F4SUyHi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1816 wrote to memory of 1316	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1316	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1316	1816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92b272c8d70cb1463862bb8e2549cd0ea3cab134df4a80f0f094258e0892dc84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92b272c8d70cb1463862bb8e2549cd0ea3cab134df4a80f0f094258e0892dc84.dll,#1
2⤵
PID:1316