24fbd4e7bdf9163607652a0c0d0a08b83b3eea531cf81a27f53922a5f87eefc3

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 19:45

Target

24fbd4e7bdf9163607652a0c0d0a08b83b3eea531cf81a27f53922a5f87eefc3.dll
Size

6KB
MD5

4401df25825ac1a5a4db9a6075df380b
SHA1

0f5c2b355530207c37906a49da8a541e6faef82e
SHA256

24fbd4e7bdf9163607652a0c0d0a08b83b3eea531cf81a27f53922a5f87eefc3
SHA512

421a74e59e226611af05709cc2e0254a4c331646ded63736e63509f614ea1a18754490ffa8992e98908d334a58bcf92888dc3f2eac6bf4c194ddc1d1cfe5a94f
SSDEEP

96:hy859x0P8MaGeBTXqaHIJUaMaI35N1bUMBe3QbiTmNq1JS+:F5oLDtJUafC5N1bBbMmNqLb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 4636	532	rundll32.exe	80
PID 532 wrote to memory of 4636	532	rundll32.exe	80
PID 532 wrote to memory of 4636	532	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24fbd4e7bdf9163607652a0c0d0a08b83b3eea531cf81a27f53922a5f87eefc3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24fbd4e7bdf9163607652a0c0d0a08b83b3eea531cf81a27f53922a5f87eefc3.dll,#1
  2⤵
  PID:4636