bac0f594ffcff10feb36a1078dae4ae94be51f16e06368fc8ba2728cf056f4af

Analysis

max time kernel
98s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 13:17

Target

ca60af4de24b3b40ba85a153facfd6c0N.dll
Size

7KB
MD5

ca60af4de24b3b40ba85a153facfd6c0
SHA1

ebf4009be4b791d451b78dce5699621cda25d63d
SHA256

bac0f594ffcff10feb36a1078dae4ae94be51f16e06368fc8ba2728cf056f4af
SHA512

02d895c649dfef6851a1c8b5b4e37edbff8d1b9b61d2d4f975f2c01bc8790e817d65f0ccc70e0f9226c9b954779577f5f7ea8824e49b0b9b17c60c31d607f3e9
SSDEEP

48:SsGp63gAST0cMLlD7prUlG9NzgCzqn9Fz1frOGgKqdwV/tut3vO/vzjbsxdArK/R:VGEETrMLH5Xzqn9PRj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 376	4368	rundll32.exe	84
PID 4368 wrote to memory of 376	4368	rundll32.exe	84
PID 4368 wrote to memory of 376	4368	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca60af4de24b3b40ba85a153facfd6c0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca60af4de24b3b40ba85a153facfd6c0N.dll,#1
  2⤵
  PID:376