dcdffe13ebac97ffd8f5782303b1c5d5bfb03f8d06592ab1c1a8ec39669f2548

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 06:36

Target

dcdffe13ebac97ffd8f5782303b1c5d5bfb03f8d06592ab1c1a8ec39669f2548.dll
Size

1.3MB
MD5

eee1542449e5ccec11ce8fdf7576b0aa
SHA1

485ad4dedafab5cc55b95d75030d15e2bbb7e74c
SHA256

dcdffe13ebac97ffd8f5782303b1c5d5bfb03f8d06592ab1c1a8ec39669f2548
SHA512

afd9089e6ab2e1c860852d7f92e6e24edebd1f53c82f26b53257b0488898da20bfc7b9c71d705b3477fb749acd161b191b5bdd9d6377e2225a9c85f81b32e645
SSDEEP

24576:YETgmHzfe71hLXEkqXdG7p1XUYO4AzDAI7qrEH7U:YEpHzm77qXdGl1XUYCzDA+O

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4500	3288	rundll32.exe	83
PID 3288 wrote to memory of 4500	3288	rundll32.exe	83
PID 3288 wrote to memory of 4500	3288	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcdffe13ebac97ffd8f5782303b1c5d5bfb03f8d06592ab1c1a8ec39669f2548.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcdffe13ebac97ffd8f5782303b1c5d5bfb03f8d06592ab1c1a8ec39669f2548.dll,#1
  2⤵
  PID:4500