b02793565df0e64e7e583a41aa99e510d66b8948b4d6fa02b83f22b5ad6f1d74

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:10

Target

b02793565df0e64e7e583a41aa99e510d66b8948b4d6fa02b83f22b5ad6f1d74.dll
Size

2.3MB
MD5

567fc21eb586e719dbdbff3242aaa1f0
SHA1

d5c43e4a53fc0b9e3dfd9e3661d522a05e2e8422
SHA256

b02793565df0e64e7e583a41aa99e510d66b8948b4d6fa02b83f22b5ad6f1d74
SHA512

71694248b8502ea809a16e826bf420958b9d3ca348325d3922e6f71892a8d757872297747b88179062d0b865a06e184be520f57a0b52c916395df60f6d7f977b
SSDEEP

49152:Bar8oPKHkKGsr1VLw6sxkgASVCTxByGJmemB:8Ktr1BgCBB0XB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 3684	996	rundll32.exe	83
PID 996 wrote to memory of 3684	996	rundll32.exe	83
PID 996 wrote to memory of 3684	996	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b02793565df0e64e7e583a41aa99e510d66b8948b4d6fa02b83f22b5ad6f1d74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b02793565df0e64e7e583a41aa99e510d66b8948b4d6fa02b83f22b5ad6f1d74.dll,#1
  2⤵
  PID:3684