75f75f0449d5f42bd60d5c7a56a8ca89ff19a5d4494c95ca3fe9a11ec38438b2

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:26

Target

6e608885cc892eac7dc1c865e7bd6bd5.dll
Size

303KB
MD5

6e608885cc892eac7dc1c865e7bd6bd5
SHA1

bd29e9bebb9b10ed6082791c6836582344d0a464
SHA256

75f75f0449d5f42bd60d5c7a56a8ca89ff19a5d4494c95ca3fe9a11ec38438b2
SHA512

b347d4ca58e1dfcb4bdb2d764704984f877edc4fb504458e641465b5506f097db78fa8418953ec6e1baed37a1a182a405c092be85b898c19aa8183a59bd0e799
SSDEEP

6144:I6MMYx5EOhcoh//oct0pf1XB9FVTqmCYkk3jmsy6LBAOieSqsR:I3bhcoRAct0prFTHpTisHr0qc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 456	2740	rundll32.exe	87
PID 2740 wrote to memory of 456	2740	rundll32.exe	87
PID 2740 wrote to memory of 456	2740	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e608885cc892eac7dc1c865e7bd6bd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e608885cc892eac7dc1c865e7bd6bd5.dll,#1
  2⤵
  PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 456 -ip 456
1⤵
PID:1756

memory/456-0-0x00000000013A0000-0x00000000013AD000-memory.dmp

Filesize
52KB

Download