baa02f9b04996ad52adc3e56871ba5337b08cef0808081b6dc9ac27063459d56

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 02:36

Target

3388f2ab3f3d19649840bc4a4a652720N.dll
Size

132KB
MD5

3388f2ab3f3d19649840bc4a4a652720
SHA1

26b118081bb3aa3c8c064c3b5e57a4a191a55ecb
SHA256

baa02f9b04996ad52adc3e56871ba5337b08cef0808081b6dc9ac27063459d56
SHA512

b24250ac3dae095a1dbf1470472d44b9621c836954cdf910aa7d4c0b9e8abe4ea9e7555992947f3fc88867c63dbca9e80555ff26b6e189805f9d4526cbb90970
SSDEEP

1536:BKqXvlYMuXczvOPHInqcbvMjHMr8kvY2ORiQOLSeTtCWRyyEms/R8g8TScY1o9O1:nSuvZHNZEAScY1oUN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2836	3312	rundll32.exe	83
PID 3312 wrote to memory of 2836	3312	rundll32.exe	83
PID 3312 wrote to memory of 2836	3312	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3388f2ab3f3d19649840bc4a4a652720N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3388f2ab3f3d19649840bc4a4a652720N.dll,#1
  2⤵
  PID:2836