67bcbdfb85e618fbbe72a07c2830208f9db799a042a42493d18a4ff51d9a22ad

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:59

Target

67bcbdfb85e618fbbe72a07c2830208f9db799a042a42493d18a4ff51d9a22ad.dll
Size

87KB
MD5

aca7a9fba136095906068fd759e14740
SHA1

cd40ede03b3390f4fecb2159de9b9040419db1fd
SHA256

67bcbdfb85e618fbbe72a07c2830208f9db799a042a42493d18a4ff51d9a22ad
SHA512

2c81a2696bc273ec77d3576e02cc7b247266ab2a14ca7e5515aa2d45349d42c98aa2d6583c147990709f34542573b4741fef4796c17809ae7b7852838d62adab
SSDEEP

1536:h3lhVHILArYQanULljR+cv/DCSJ8VGsMJFRGMj:ZtFcVURjRb/DCSJ8VGsMJFT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2684 wrote to memory of 5116	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 5116	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 5116	2684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67bcbdfb85e618fbbe72a07c2830208f9db799a042a42493d18a4ff51d9a22ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67bcbdfb85e618fbbe72a07c2830208f9db799a042a42493d18a4ff51d9a22ad.dll,#1
2⤵
PID:5116