c6e67b6caf12cbe7329578a46ff2b05b662f171185f537d98ab6166f6906871c

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 12:05

Target

1ce7ef963c94739f47716edf6e50715b.dll
Size

21KB
MD5

1ce7ef963c94739f47716edf6e50715b
SHA1

5857a003f7d69ae7f8858b11ffdc0718929877c1
SHA256

c6e67b6caf12cbe7329578a46ff2b05b662f171185f537d98ab6166f6906871c
SHA512

dddc8c302d50409eebdb39f9581df8f75785ef30cef2abf09afaf79f0fb3e0ef702fb79a4a28071d95365b8775027ca293102e67fb6549bc6b8801b289866223
SSDEEP

384:zEzRym/fm5pfHoji5lpv2LaweowvFRvKGtyLK3ewPNnh+1jlCLQtjRiP0nRFffTI:pBoj6CdenEK3pZkkUjRiP0nRB3A0tA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4536	3792	rundll32.exe	16
PID 3792 wrote to memory of 4536	3792	rundll32.exe	16
PID 3792 wrote to memory of 4536	3792	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ce7ef963c94739f47716edf6e50715b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ce7ef963c94739f47716edf6e50715b.dll,#1
  2⤵
  PID:4536