e69b742fa53147b2697a40c3ab05199c84cc91df2315ad0680dc9b86b61f76ed

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 06:37

Target

5db126ce4329c7a06ae8c4d30784f6f0N.dll
Size

4.6MB
MD5

5db126ce4329c7a06ae8c4d30784f6f0
SHA1

313996a6ded4d17a747f1383e24a907362fe3e28
SHA256

e69b742fa53147b2697a40c3ab05199c84cc91df2315ad0680dc9b86b61f76ed
SHA512

a57c2b8e1a25d780fa2e83a330b214d145ddc9b5584ee5f0ef6b0c08505c4953fbbae0d8ca73aa28be99cde321b41103a3dcf754d9fd44f5c92469f515a07f68
SSDEEP

98304:NPMvLNHzP6JliHXLa41RaywJkwon+AoQ69fYWF8irG4FjXLPJ:NiiMHr1R12kOAFSYAhHXLR

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 3772	2484	rundll32.exe	84
PID 2484 wrote to memory of 3772	2484	rundll32.exe	84
PID 2484 wrote to memory of 3772	2484	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5db126ce4329c7a06ae8c4d30784f6f0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5db126ce4329c7a06ae8c4d30784f6f0N.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

memory/3772-1-0x0000000074570000-0x0000000074CA2000-memory.dmp

Filesize
7.2MB

Download
memory/3772-0-0x0000000001050000-0x0000000001051000-memory.dmp

Filesize
4KB

Download
memory/3772-4-0x000000007458D000-0x0000000074808000-memory.dmp

Filesize
2.5MB

Download
memory/3772-5-0x0000000074570000-0x0000000074CA2000-memory.dmp

Filesize
7.2MB

Download
memory/3772-6-0x0000000074570000-0x0000000074CA2000-memory.dmp

Filesize
7.2MB

Download
memory/3772-7-0x000000007458D000-0x0000000074808000-memory.dmp

Filesize
2.5MB

Download