b428ecbadff305e5ff7a2c7993f3ff44c4820a48a735c5c55f8dcbc93c32820b

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 01:50

Target

b428ecbadff305e5ff7a2c7993f3ff44c4820a48a735c5c55f8dcbc93c32820b.dll
Size

7.1MB
MD5

158fd8f733ebd12b3f06e0611c3d0a33
SHA1

f32f807110a6c7ab3632f45671a7a078aa2935da
SHA256

b428ecbadff305e5ff7a2c7993f3ff44c4820a48a735c5c55f8dcbc93c32820b
SHA512

b3d03d6d4b7c1138780f3d796741a4cb32c672d11c0c76de102b2fe23f5d1bf5590269b43b3b0284e0f1a9a90cefb3ceaf9e5a3fdb75ee8b519d7411321d504f
SSDEEP

98304:Kche4hvsjnWtSfxZu3WTQwFcgdxUFZ9LWEDctV5jIqB4n0hLXR:KSvsjnWcfxZu6LFUZWEDctVBO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 2700	3468	rundll32.exe	85
PID 3468 wrote to memory of 2700	3468	rundll32.exe	85
PID 3468 wrote to memory of 2700	3468	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b428ecbadff305e5ff7a2c7993f3ff44c4820a48a735c5c55f8dcbc93c32820b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b428ecbadff305e5ff7a2c7993f3ff44c4820a48a735c5c55f8dcbc93c32820b.dll,#1
  2⤵
  PID:2700