ad4ee1ecbe30186efdb87d1e0e51b42929affe02af0d16c5bd1077f92500c3b1

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:49

Target

ad4ee1ecbe30186efdb87d1e0e51b42929affe02af0d16c5bd1077f92500c3b1.dll
Size

5KB
MD5

f3cc154bbad3fc748a1e37d4e909e9e2
SHA1

1ec90451c27a16c08b1c37ade9881ea0ff2681f5
SHA256

ad4ee1ecbe30186efdb87d1e0e51b42929affe02af0d16c5bd1077f92500c3b1
SHA512

06d5a2f620854b646bd134f1c59a194f0478bd96e692047f4a85967982d5fcdcf5f52c7c5385812bca302e5171e17725e09eb688e14a246b22a8aaadf0b47f0a
SSDEEP

96:hy859x0P8Ma+C4+T/7z1bDamgraWfVOyfNqGkzyzVR:F5oLBC4+T/7zl+mgzfNqGxR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 388 wrote to memory of 3144	388	rundll32.exe	rundll32.exe
PID 388 wrote to memory of 3144	388	rundll32.exe	rundll32.exe
PID 388 wrote to memory of 3144	388	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad4ee1ecbe30186efdb87d1e0e51b42929affe02af0d16c5bd1077f92500c3b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad4ee1ecbe30186efdb87d1e0e51b42929affe02af0d16c5bd1077f92500c3b1.dll,#1
2⤵
PID:3144