b4de8aaac52e9c595b9298723b0e4e7b6f9b45ae7fe695e611e5eb68b60735c5

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 02:19

Target

b4de8aaac52e9c595b9298723b0e4e7b6f9b45ae7fe695e611e5eb68b60735c5.dll
Size

6KB
MD5

9dc4074e137d2705c26ce26f1dbecf18
SHA1

5c437a4eb779d5dd40803f4fbd57d396b9860051
SHA256

b4de8aaac52e9c595b9298723b0e4e7b6f9b45ae7fe695e611e5eb68b60735c5
SHA512

9f60a90d50892119052da428149ccc5ef4dd9e304321af7767ac67ded4148a6e9f94dadb7b15bce68b522adad124c254caaa5ef67843b21b1e35f5c1f37db985
SSDEEP

96:DixZjmjtjd8jPjcZGR5TI3qhboEkuHFst9T+PCDJmZ3FARhWDZiJdXFFmx:unSR6bgYthboaHwwPCMV/Zu9FF0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2968	2468	rundll32.exe	81
PID 2468 wrote to memory of 2968	2468	rundll32.exe	81
PID 2468 wrote to memory of 2968	2468	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4de8aaac52e9c595b9298723b0e4e7b6f9b45ae7fe695e611e5eb68b60735c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4de8aaac52e9c595b9298723b0e4e7b6f9b45ae7fe695e611e5eb68b60735c5.dll,#1
  2⤵
  PID:2968