368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:57

Target
368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d.dll
Size 1.0MB
Sample240612-flgfma1flj
SHA256 368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d
MD5 68dd3315e6025551422cc8d151b30f35
SHA1 21a2896d50fb22d75322353c470c6d53218ccfa3
SHA512 c0d29661dc1c798476ddc952a2c80010dfada3f8614a9232a8bdc396aee721f06119199d8d63ebfe0172de048eeba13d1c117cc3aa25715f33cfc05cde82bc21
SSDEEP 12288:VmO5sFyb8WMYX5nSnx1tMti/rgDWa7TjO5Z203pDD0NpTbT04T:EO5sWpSnxljgSa7Tjp03pX0PTbA4T
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5004	4540	rundll32.exe	80
PID 4540 wrote to memory of 5004	4540	rundll32.exe	80
PID 4540 wrote to memory of 5004	4540	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\368bc7bac081beffbda2e9ae221b679a43740d046304fc332d6bd7193edd2d9d.dll,#1
  2⤵
  PID:5004