e41f051ecec212a40f6d0e674a378c42d8490218feb8b13b7bd0abcd702e07d4

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 21:39

Target

6618c70e8014e55f1584b81a80397519.dll
Size

24KB
MD5

6618c70e8014e55f1584b81a80397519
SHA1

f7974bb8039a9315aaf45305bf060c905e693d44
SHA256

e41f051ecec212a40f6d0e674a378c42d8490218feb8b13b7bd0abcd702e07d4
SHA512

6b592cbfa0dbff0e2b0bd15caaacde351748444e43da5791cfe98177b520140aab3cb47d322b37f30865fa2c606a324cfe69e602d383e312b16a8b2fa05b4726
SSDEEP

192:vTKp/isInFbtE2vmIz/HavGy3lY+gCNdhUHMyEnM0nnXSvtApct5Un:vTKJtInF3OILuY+mYtnXSOpct5i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2344	4264	rundll32.exe	85
PID 4264 wrote to memory of 2344	4264	rundll32.exe	85
PID 4264 wrote to memory of 2344	4264	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6618c70e8014e55f1584b81a80397519.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6618c70e8014e55f1584b81a80397519.dll,#1
  2⤵
  PID:2344