49904badb0dc2947be87c4aef2bd3646ed0dd566826b5c003a2b7e15ca59b04c

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2024 16:41

Target

6d823aaee80cffb8da420d5a54086268.dll
Size

48KB
MD5

6d823aaee80cffb8da420d5a54086268
SHA1

f8607a13d57629be64d93645a140e9e568cae185
SHA256

49904badb0dc2947be87c4aef2bd3646ed0dd566826b5c003a2b7e15ca59b04c
SHA512

018332a0bcb18b015f2dbaa6319111ac07e69c8d284d4cd5879fd7a397583500da34916031752502dc6680a46c52a67d691813b24802a2768c31a45533fb1ec7
SSDEEP

768:BR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMI+V:8aAoHoc2x7bZoYBAcQlwJdMG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2652 wrote to memory of 4516	2652	rundll32.exe	85
PID 2652 wrote to memory of 4516	2652	rundll32.exe	85
PID 2652 wrote to memory of 4516	2652	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d823aaee80cffb8da420d5a54086268.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d823aaee80cffb8da420d5a54086268.dll,#1
  2⤵
  PID:4516