74e35cb43f831c2469de593452a5061bd624360a082cfff3b30488a98830c0ed

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:09

Target

74e35cb43f831c2469de593452a5061bd624360a082cfff3b30488a98830c0ed.dll
Size

81KB
MD5

f7de3111d4ebb3c043fc65021a7bc230
SHA1

9224bdee26035d964e7d6a4c8c70d332254af70d
SHA256

74e35cb43f831c2469de593452a5061bd624360a082cfff3b30488a98830c0ed
SHA512

62c7f6becc57731c9b1b5031dacf1fd7aa349ae3935b4b56a7b3e91f8ec2c618e6c848d74bb76a958e999369713421358d7c0e78bcdcc4072116d6a5737ae4f9
SSDEEP

1536:JtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WX:J4v4JKXTx71w0ArSsXF3enq8WX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 4600	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 4600	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 4600	1904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74e35cb43f831c2469de593452a5061bd624360a082cfff3b30488a98830c0ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74e35cb43f831c2469de593452a5061bd624360a082cfff3b30488a98830c0ed.dll,#1
2⤵
PID:4600