e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:35

Target

e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b.dll
Size

6KB
MD5

40e172f4bed25a2ec773c217cf112ce2
SHA1

3cd003eba77d91a141c2307e66da1ef6bd20a992
SHA256

e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b
SHA512

38495d2d2a72bec2c294a7e541ba895c30162cfce112cc7066941dfed7eb1915a1a9a0bf1ea7efb05278d74cf87a2ebefd0f2ba42702d6e42c06cbcc0d209b92
SSDEEP

48:63mll5YVOa9VUX1iwbQWu03AB+BDq9J5SH:VDa9VUX9bQWXAB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2648	3032	rundll32.exe	81
PID 3032 wrote to memory of 2648	3032	rundll32.exe	81
PID 3032 wrote to memory of 2648	3032	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e354c8a8b7b596fd0d32222fa602684f97403279e7795abdae67f26b873d509b.dll,#1
  2⤵
  PID:2648