6a9c132bc8a12f6d40dd7c237d0909facb8267da54c3f84fab8bbdaae5ee479e

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:39

Target

1141b3b15b5c140383b41c581ea2ef6b.dll
Size

76KB
MD5

1141b3b15b5c140383b41c581ea2ef6b
SHA1

dfac6b57c57dd18a813dda03531812d80d42f632
SHA256

6a9c132bc8a12f6d40dd7c237d0909facb8267da54c3f84fab8bbdaae5ee479e
SHA512

483b6a8f5354d0165c65c811d94745af3b70883fe86dfb851b976d8cc90e8a068d9325c6f57c47b7c4ca587665e7b7a6125cbe4254254b9305c9dd689559470f
SSDEEP

768:7HPF9c2tgipe3Un+afZIx0H1wyoTVmdHBwmTdW1URWTCiB9VbU5DoLVZ5bbs6Di5:7PbTgP2Q0H1roTVIBwmTdWyWt5s6W5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 1532	4488	rundll32.exe	53
PID 4488 wrote to memory of 1532	4488	rundll32.exe	53
PID 4488 wrote to memory of 1532	4488	rundll32.exe	53

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1141b3b15b5c140383b41c581ea2ef6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1141b3b15b5c140383b41c581ea2ef6b.dll,#1
  2⤵
  PID:1532