fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e

Analysis

max time kernel
142s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 22:55

Target

fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e.dll
Size

6.2MB
MD5

a663ce598d8a56e0ca456703d721f256
SHA1

ecd233207007a00cdec3da429cfefea9d1e61a4b
SHA256

fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e
SHA512

bd1d3c4c9b212278e869c5f10ff21d574168def53c062ffdda411ef603e9085d380760fa365816833ccbea49225537d9388466167964dc060c89b6bd65710205
SSDEEP

49152:TLffoJlkBlx7qmX0lPFgPT8I7fhQh2dERd9Twr3En6U3cljx0B1mHK1vQtQndFX+:TLYJsNzWN48IjhQu3t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 732	3452	rundll32.exe	84
PID 3452 wrote to memory of 732	3452	rundll32.exe	84
PID 3452 wrote to memory of 732	3452	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb4e9f923193602b0955f633cd35ae7db7fe32ea3ea8a43fd588a4c837e001e.dll,#1
  2⤵
  PID:732

memory/732-0-0x0000000074FB0000-0x000000007561D000-memory.dmp

Filesize
6.4MB

Download