c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:44

Target

lib/bin/dt_socket.dll
Size

13KB
MD5

4c94557411dfddcb4febd401568a2c5a
SHA1

095275cc38afa66caf6dbf92ba84af3c635c123f
SHA256

509b6986a494c2440b8bf1f96b8c1976b7a7059a6e22942818d91e17e7ecb040
SHA512

0c2082238463c732ceb7618107f0ff82a1ccb0eac7374c1bc97b274ebe1fe50e0c883379583da762ef25d2f25757b39c0b1d449fe445048b1c6a100c7dbb3c27
SSDEEP

192:kXiWNRVcsKNXBREiOrqa+0M9gYnb/tSO5n89qQuWr/qSpgItvo9f2bbH:UiWbODXBaxq30xYbJn8LSfkbH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2316	4960	rundll32.exe	83
PID 4960 wrote to memory of 2316	4960	rundll32.exe	83
PID 4960 wrote to memory of 2316	4960	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\dt_socket.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\dt_socket.dll,#1
  2⤵
  PID:2316