f715e92e70039ad90cabcb434cdc0a377b5e0769825ea5c318b1e0471a10e026

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 05:11

Target

f715e92e70039ad90cabcb434cdc0a377b5e0769825ea5c318b1e0471a10e026.dll
Size

7KB
MD5

d91a1c65a7c240538bf4c38c297353fd
SHA1

7a92e8af7fd8b65427ed3027938e796d381b7530
SHA256

f715e92e70039ad90cabcb434cdc0a377b5e0769825ea5c318b1e0471a10e026
SHA512

cd8b263e02d4fa12d68a89a7ef6753b3152e6362de126f0c06bd68781c6bfc652ee44b00dfe8e8625b66dd0d5d426c11dd9843027f4ad6cfd1387688d05782e7
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWkJbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPQq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 4680	5340	rundll32.exe	81
PID 5340 wrote to memory of 4680	5340	rundll32.exe	81
PID 5340 wrote to memory of 4680	5340	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f715e92e70039ad90cabcb434cdc0a377b5e0769825ea5c318b1e0471a10e026.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f715e92e70039ad90cabcb434cdc0a377b5e0769825ea5c318b1e0471a10e026.dll,#1
  2⤵
  PID:4680