642f143b4f23135bfebcf6969fd7ded2d830a2ecb9c985712717ff0a1b4316ae

Analysis

max time kernel
144s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 11:54

Target

6c64849fb5f579e7e711399d5233dbd3.dll
Size

1.0MB
MD5

6c64849fb5f579e7e711399d5233dbd3
SHA1

22ca7bc9fa1dc4c31fa58f629884374cc4ec963e
SHA256

642f143b4f23135bfebcf6969fd7ded2d830a2ecb9c985712717ff0a1b4316ae
SHA512

296be93f5ec85a24e5414081a84b2740abd76742814700dcd7f8e9c45efa9aacc673e2760653765124ec22b3d0d6c8edb09c0b3fd619b02659e48532553a48a3
SSDEEP

24576:85igQymmvl0SfxNCRJ6bRAoj4TwD7Txap8YvwmLipvqYokJDYQyOEsT9YlfS:8MSvlzGJmRN4Tw/NaZwTvq9kaSEf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 1812	3476	rundll32.exe	14
PID 3476 wrote to memory of 1812	3476	rundll32.exe	14
PID 3476 wrote to memory of 1812	3476	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c64849fb5f579e7e711399d5233dbd3.dll,#1
1⤵
PID:1812

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c64849fb5f579e7e711399d5233dbd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3476

memory/1812-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download