88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 14:07

Target

88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4.dll
Size

112KB
MD5

57aa4d5beb0302fdb315551e6b091896
SHA1

0c917a227fe749a44bc3e44bc1224a2ac95909e3
SHA256

88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4
SHA512

28b62200a5889a67cc844400fda320b447e780df19a8b492d1b49f04871f54cf029ef3dd51d961f5102ac39123da59c0f01f9b26bfa11cad6fac91d723770e40
SSDEEP

3072:X0y9PkXOCx1G9Iqni8FWxqeiprBhkekg+1/1OxUmf2O5:XL9MXOhhFLlcgG1VLO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4244	1020	rundll32.exe	81
PID 1020 wrote to memory of 4244	1020	rundll32.exe	81
PID 1020 wrote to memory of 4244	1020	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4.dll,#1
  2⤵
  PID:4244

memory/4244-0-0x0000000074CD0000-0x0000000074D48000-memory.dmp

Filesize
480KB

Download
memory/4244-1-0x0000000074CD0000-0x0000000074D48000-memory.dmp

Filesize
480KB

Download