6d9067e52df908cd2d80611ec8a9d440e0122c23bb85360a8aa36c6575e7e679

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2023, 10:07

Target

6d9067e52df908cd2d80611ec8a9d440e0122c23bb85360a8aa36c6575e7e679.dll
Size

390KB
MD5

ba2b809e3e6cf108053509966f2a3d35
SHA1

913775f5e012408bfc5ad2be3bef99ebbdf9d103
SHA256

6d9067e52df908cd2d80611ec8a9d440e0122c23bb85360a8aa36c6575e7e679
SHA512

d63b6eeec78441ecebb0de59c8f47009a809c6639ff83bf5fe17c9f855c5573caf9eb7f6fde470020982af86d294e2eee9c18d531f10820e89ad747c6f2315c0
SSDEEP

3072:xAPciuIWs5OjtsU9eQSzDQ/RRRUYUZ8qR6ByyRzhLAuLAQGNAfAZXAbc4mA8W3Sf:Mc/IWeett9enoRRRTqWJhUorqDMXt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2360	2548	rundll32.exe	84
PID 2548 wrote to memory of 2360	2548	rundll32.exe	84
PID 2548 wrote to memory of 2360	2548	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d9067e52df908cd2d80611ec8a9d440e0122c23bb85360a8aa36c6575e7e679.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d9067e52df908cd2d80611ec8a9d440e0122c23bb85360a8aa36c6575e7e679.dll,#1
  2⤵
  PID:2360

memory/2360-133-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2360-134-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download