6a6ee36eff9c1924e5e2b9bbdbf55b1d80be35268d8986559de6fa79b04a3987

Analysis

max time kernel
124s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 00:23

Target

6a6ee36eff9c1924e5e2b9bbdbf55b1d80be35268d8986559de6fa79b04a3987.dll
Size

48KB
MD5

a23fa91967706c6d0ce2922e2e1fb1f9
SHA1

d35565303b56a4ef592c20f65457e34b0d71f854
SHA256

6a6ee36eff9c1924e5e2b9bbdbf55b1d80be35268d8986559de6fa79b04a3987
SHA512

e149b8db45901f98f5bc492ceca504bb679bf49cb019ee2ec0be1ac06c6e7b2b19adb78fb63c489c6139e0e4c021d817914e3a8b2cf218eac8408831884d54d3
SSDEEP

768:IjNBXJVzjjGRBgbYQ/Zjj9WjI0eQwj0Jc:WN9JVWc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 4996	2056	rundll32.exe	84
PID 2056 wrote to memory of 4996	2056	rundll32.exe	84
PID 2056 wrote to memory of 4996	2056	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6ee36eff9c1924e5e2b9bbdbf55b1d80be35268d8986559de6fa79b04a3987.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6ee36eff9c1924e5e2b9bbdbf55b1d80be35268d8986559de6fa79b04a3987.dll,#1
  2⤵
  PID:4996