b2d1819f0f8e398a73323f1920dcf02bc9897b02b51f016c19026b4aa5e4c015

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 02:03

Target

b2d1819f0f8e398a73323f1920dcf02bc9897b02b51f016c19026b4aa5e4c015.dll
Size

327KB
MD5

3704bb106090964ba9eb4539742085b3
SHA1

d524f1f507ce80f8776a9784783b3abc109354e9
SHA256

b2d1819f0f8e398a73323f1920dcf02bc9897b02b51f016c19026b4aa5e4c015
SHA512

4c854103571535346fa9851c4c3ddd60dbcde3ff997f0994939b94c591bbde2278bb78d9ba4d47a66fac410878bff5e37e363dcc88ef0811c0f0c3fb5d3b4c64
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 2264	3616	rundll32.exe	83
PID 3616 wrote to memory of 2264	3616	rundll32.exe	83
PID 3616 wrote to memory of 2264	3616	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2d1819f0f8e398a73323f1920dcf02bc9897b02b51f016c19026b4aa5e4c015.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2d1819f0f8e398a73323f1920dcf02bc9897b02b51f016c19026b4aa5e4c015.dll,#1
  2⤵
  PID:2264