6cb958bc6dd5e91393df8896cd5add48db48fe89ba5ad50d1d65c93a4a3ed7ab

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 11:31

Target

8965d7c4999a8f6ab130dfb46b12c2c6.dll
Size

108KB
MD5

8965d7c4999a8f6ab130dfb46b12c2c6
SHA1

1d8733cabdd34ec3be64e233cd6f10885ff95ab2
SHA256

6cb958bc6dd5e91393df8896cd5add48db48fe89ba5ad50d1d65c93a4a3ed7ab
SHA512

9820e4524a6ef28a7b253d63af2028dc7765b39c6651c9d05b4e060f48bf0b1410899c386c7e1f80f27d6084c23a367a136226c87ce985c8e42bdaa0a9487d49
SSDEEP

1536:0K/MFocGogybG+60Q+uEEpBl2+Q1BvEnSpEqN2PpdGixX3jHhl+lN05m:0UKocH6MQ+uZ0R15//arZ1l+lNcm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1776	2092	rundll32.exe	84
PID 2092 wrote to memory of 1776	2092	rundll32.exe	84
PID 2092 wrote to memory of 1776	2092	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8965d7c4999a8f6ab130dfb46b12c2c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8965d7c4999a8f6ab130dfb46b12c2c6.dll,#1
  2⤵
  PID:1776