6d3ff9a1f4745625b44f5361e4d8d78b38898d24eddaf328c2448a2bb377c99a

Analysis

Target

6d3ff9a1f4745625b44f5361e4d8d78b38898d24eddaf328c2448a2bb377c99a.dll
Size

248KB
MD5

d06b6befe1e077637c40604c6d3ddfa1
SHA1

fb70eb95d5c589391796f2400c729888797ea9ef
SHA256

6d3ff9a1f4745625b44f5361e4d8d78b38898d24eddaf328c2448a2bb377c99a
SHA512

7210f15a4bccc017e442654751f26b0b1e59d187654c8a2c060731921440d50bd8ad62689ff7ad938ecd38f472ccc4bb9fb9780c1c33f3a4e9ce770ff4da8f44

Score

5^/10

Suspicious use of SetThreadContext 3 IoCs

Suspicious use of FindShellTrayWindow 9 IoCs

Suspicious use of SendNotifyMessage 9 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4860	4896	rundll32.exe	82
PID 4896 wrote to memory of 4860	4896	rundll32.exe	82
PID 4896 wrote to memory of 4860	4896	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d3ff9a1f4745625b44f5361e4d8d78b38898d24eddaf328c2448a2bb377c99a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d3ff9a1f4745625b44f5361e4d8d78b38898d24eddaf328c2448a2bb377c99a.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4860