0ec41a5a3af0ce1feedcf03f755c0b7df8866b1dbba47d9c9a4e9db1120f12f1

Analysis

max time kernel
88s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 01:52

Target

3a69a1d04476a8f8113a81f08e026aa0N.dll
Size

36KB
MD5

3a69a1d04476a8f8113a81f08e026aa0
SHA1

87f0cc813edd15b8ba628562ba100b6fccdee342
SHA256

0ec41a5a3af0ce1feedcf03f755c0b7df8866b1dbba47d9c9a4e9db1120f12f1
SHA512

4fdc08bf8d84895a5a741301b3fa069fac141b408e3e55f8859c04423ec5e892513c0bf18839903c43af7ae5f23883a6a6a4910e13139f3db41a625c44d99658
SSDEEP

96:IB+HMax5Ov157HGgjRX2GS84JkAAjBQGq/IjNKyuf0oEoW+7aVR8:IslxI5jG6DthlcIjNKVNRW+7IR8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2212	1756	rundll32.exe	84
PID 1756 wrote to memory of 2212	1756	rundll32.exe	84
PID 1756 wrote to memory of 2212	1756	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a69a1d04476a8f8113a81f08e026aa0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a69a1d04476a8f8113a81f08e026aa0N.dll,#1
  2⤵
  PID:2212