ef9a3cbd84c17d7a0aabccc5b31b5281b64002e49173cb675dc72c4697421067

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 05:19

Target

ef9a3cbd84c17d7a0aabccc5b31b5281b64002e49173cb675dc72c4697421067.dll
Size

6KB
MD5

ba8d7f1592d0a05c0c2634c62e8de4a1
SHA1

24e0c08b73aff87bdf62b4420b0e460720e4c193
SHA256

ef9a3cbd84c17d7a0aabccc5b31b5281b64002e49173cb675dc72c4697421067
SHA512

f276e70c9f130868e84d133b102e39cf262531cf0943462ac9e449f90f9880c330aa5b6697b79a06b90bde7fca6c98061e65393d33e65bd59c5d85372d35aea8
SSDEEP

48:6++Z5YVOeJVkrm1pwbEX7PFUE7aaO0ykB+BDq9J5S1XU:6eJVkrmgbCbFUaaavB+FqX5S1k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4616	4856	rundll32.exe	82
PID 4856 wrote to memory of 4616	4856	rundll32.exe	82
PID 4856 wrote to memory of 4616	4856	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef9a3cbd84c17d7a0aabccc5b31b5281b64002e49173cb675dc72c4697421067.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef9a3cbd84c17d7a0aabccc5b31b5281b64002e49173cb675dc72c4697421067.dll,#1
  2⤵
  PID:4616