5c41a6b98890b743dd67caa3a186bf248b31eba525bec19896eb7e23666ed872

Analysis

max time kernel
141s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 04:21

Target
4a6cfe6c785e9cfa0c326d11ec9c5a88.dll
Size 13KB
Sample240108-ey1vcscac3
SHA256 5c41a6b98890b743dd67caa3a186bf248b31eba525bec19896eb7e23666ed872
MD5 4a6cfe6c785e9cfa0c326d11ec9c5a88
SHA1 3ee4edfd6fa0c8297634b0fff83c61c5f9ea3056
SHA512 b0369510f94a5d402871660070ce61fa49e6f25ea0a509a17c83d71245a3609e8ee521c924290b9a99fb5e7faf378b3b88c255c02636b34643b2e6529f2813aa
SSDEEP 192:oOl4dcZjN0N5DcE6pNBkQ+ReOxhs35JPN47wdCozV6TlRAj3aQu:nmAE6jmJFxe3zPN4MdC/XUP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1936	4060	rundll32.exe	14
PID 4060 wrote to memory of 1936	4060	rundll32.exe	14
PID 4060 wrote to memory of 1936	4060	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a6cfe6c785e9cfa0c326d11ec9c5a88.dll,#1
1⤵
PID:1936

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a6cfe6c785e9cfa0c326d11ec9c5a88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060