797ed1840b34208584bf27a72ccd2017e65309bb1b23822368b911e3a5dd4bea

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:23

Target
797ed1840b34208584bf27a72ccd2017e65309bb1b23822368b911e3a5dd4bea.dll
Size 5KB
Sample240614-apy7ys1dqk
SHA256 797ed1840b34208584bf27a72ccd2017e65309bb1b23822368b911e3a5dd4bea
MD5 795a7c5968affd3fcf704bd2d451623a
SHA1 592153bc5eceea5bc892737ff0aea13c49f0bb8c
SHA512 113312421956168677b67a4057a5bd893845f0462874049d144066bca0a1cdbe2fbb22734ab920264d2bc55df542fbe5cceeee640548e6ad57451bb9cb2be24a
SSDEEP 48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqjtQ+yOFCn9hGxZSXcHtybsAtJnIGOvUiGh:hy859x0P8MaBFCnqHucHb29Ovmh
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4536	4032	rundll32.exe	82
PID 4032 wrote to memory of 4536	4032	rundll32.exe	82
PID 4032 wrote to memory of 4536	4032	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\797ed1840b34208584bf27a72ccd2017e65309bb1b23822368b911e3a5dd4bea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\797ed1840b34208584bf27a72ccd2017e65309bb1b23822368b911e3a5dd4bea.dll,#1
  2⤵
  PID:4536