b53d9e01b1dd9f9ba64d8ebb916a5bb72376019cd740e7f71e2300f5ab0cfbdb

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:11

Target

b53d9e01b1dd9f9ba64d8ebb916a5bb72376019cd740e7f71e2300f5ab0cfbdb.dll
Size

327KB
MD5

847fa48f56234c0880bb81c50986ef02
SHA1

fbdda4998a9f1349cac4e13a70560ffc00fe94f2
SHA256

b53d9e01b1dd9f9ba64d8ebb916a5bb72376019cd740e7f71e2300f5ab0cfbdb
SHA512

a4c03aa1912c7bd83beb253086ffc1ccfd710ac418243eba80b656fb5ff197916d7dfb8408e0bc83300509c73312e91ebaeb467c6d1e8efd61ae760aa575f69e
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 212 wrote to memory of 1952	212	rundll32.exe	rundll32.exe
PID 212 wrote to memory of 1952	212	rundll32.exe	rundll32.exe
PID 212 wrote to memory of 1952	212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b53d9e01b1dd9f9ba64d8ebb916a5bb72376019cd740e7f71e2300f5ab0cfbdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b53d9e01b1dd9f9ba64d8ebb916a5bb72376019cd740e7f71e2300f5ab0cfbdb.dll,#1
2⤵
PID:1952