2d77acd4c7b1cbea6844c312ada0d9b01f56a75fc240fd11a992df2011c8be92

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 05:38

Target

aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll
Size

5.0MB
MD5

440810b008eed766f085b69b1723f54b
SHA1

9692644974071cd484455e355f8d79ce8c486e20
SHA256

aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558
SHA512

99f37c6f1e31c79836427297a15292e79f3a6dcf90e128ab721bbc57ed8e0ca4ab14d662c74bbf7c9c1c6ae66fb5b772a706d0940b487289f7397d1c15ce67a9
SSDEEP

98304:bMHGypxjgEqr4y5f18zKUC11G5+ovCoTUYPK7RP684:b0/Dj8fBUC1g5+ovC4BPKc84

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4008 wrote to memory of 536	4008	rundll32.exe	rundll32.exe
PID 4008 wrote to memory of 536	4008	rundll32.exe	rundll32.exe
PID 4008 wrote to memory of 536	4008	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1
2⤵
PID:536

memory/536-10-0x00000000753E0000-0x00000000758DF000-memory.dmp

Filesize
5.0MB

Download
memory/536-0-0x0000000010000000-0x00000000104B0000-memory.dmp

Filesize
4.7MB

Download