6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114

Resubmissions

12/06/2023, 19:25

12/06/2023, 19:19

max time kernel
87s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2023, 19:19

Target
6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114.dll
Size 260KB
Sample230612-x1mdvsdd65
SHA256 6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114
MD5 d5916cb2ff52e0411bc80a716b2aa528
SHA1 98baa0c511f8595f3a8b28c5ae1d69717b855791
SHA512 618ef15305dd64d82e65e81fee659a59313998fab0d493accc122cc6795abbffcf1e31bcb1aff34413706c220777b3834a8f46240e60aca85e8d1d523f990deb
SSDEEP 6144:woGZATIJ/rRDAmZ0CI1jp8qTiAS1fW0PBJ+Y:woGGTM/hnZ0VayYv+Y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 4520	748	rundll32.exe	84
PID 748 wrote to memory of 4520	748	rundll32.exe	84
PID 748 wrote to memory of 4520	748	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6cb2f1add8817b27b351e9c97fb7067bed9a24038a7a37ece26a7012c6b114.dll,#1
  2⤵
  PID:4520

memory/4520-133-0x00000000755A0000-0x00000000755E4000-memory.dmp

Download

memory/4520-134-0x00000000755A0000-0x00000000755E4000-memory.dmp

Download