404d8069f0358193c97cdb71f4d42cdfe98389e4129ac4a7fd53adf433cf71b8

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:37

Target
404d8069f0358193c97cdb71f4d42cdfe98389e4129ac4a7fd53adf433cf71b8.dll
Size 253KB
Sample240603-ptyjjsga43
SHA256 404d8069f0358193c97cdb71f4d42cdfe98389e4129ac4a7fd53adf433cf71b8
MD5 38bd3ad818789b1c158d27c1638cb7f4
SHA1 f9c9c8b3ab1d4ec445e465f15c2a93246c63a874
SHA512 75bd06dc0db7ee6ff7ea5c76b956e2557c8d211a92f755409f1d8e172d9ec00591fc4bc6fa63ef581f66515df86e3983fa0102b21638a60aac8de1fe7813bc2a
SSDEEP 6144:oJYRVNoX1x6BWCZrWC2sRbYirayShBV+UdvrEFp7hKBB:omRVNU1x6BLZ71rWhBjvrEH7E
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3860	3444	rundll32.exe	81
PID 3444 wrote to memory of 3860	3444	rundll32.exe	81
PID 3444 wrote to memory of 3860	3444	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\404d8069f0358193c97cdb71f4d42cdfe98389e4129ac4a7fd53adf433cf71b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\404d8069f0358193c97cdb71f4d42cdfe98389e4129ac4a7fd53adf433cf71b8.dll,#1
  2⤵
  PID:3860