634d49518bf3592586fedefc2417bcb690708efd833f83ab22f195919aa5fd8b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:49

Target

634d49518bf3592586fedefc2417bcb690708efd833f83ab22f195919aa5fd8b.dll
Size

81KB
MD5

b63b77f502881f27307afe35a78b3a03
SHA1

fbec96b3bb72a2e817df4aecde6a831f56d49018
SHA256

634d49518bf3592586fedefc2417bcb690708efd833f83ab22f195919aa5fd8b
SHA512

172cae4847d80d3091f70b63e0fb7690b62f31920b4a9c299932e5680a4c6fef50c8ae6df9e3b8c31cd6745c413e8de7223058c80a7937d8ae3799b9dcac1cdd
SSDEEP

1536:Fc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+Gt:i+5oxmqAiR8+/RBkez0U+W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4188	4472	rundll32.exe	82
PID 4472 wrote to memory of 4188	4472	rundll32.exe	82
PID 4472 wrote to memory of 4188	4472	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\634d49518bf3592586fedefc2417bcb690708efd833f83ab22f195919aa5fd8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\634d49518bf3592586fedefc2417bcb690708efd833f83ab22f195919aa5fd8b.dll,#1
  2⤵
  PID:4188