b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1

Analysis

max time kernel
134s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:19

Target

b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1.dll
Size

327KB
MD5

68c244a3021cb7a712efcb0c31d92ec8
SHA1

e2129517bc3af56b6d8883099328ab4d2b6a421a
SHA256

b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1
SHA512

991bf4411ea36fef1fe89e1385822184787028aa297cebe31dc1bb330c8c478e1a7957dcd848fa84d9124bb0334f82d47fbebbe858b928089d2e46e0bf9a0318
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4416 wrote to memory of 1220	4416	rundll32.exe	rundll32.exe
PID 4416 wrote to memory of 1220	4416	rundll32.exe	rundll32.exe
PID 4416 wrote to memory of 1220	4416	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1.dll,#1
  2⤵
  PID:1220