6bbe905cefacb0f2cfa7069e044b5f350de27ea15f0e9e4d9597192fa0ec91e5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 08:30

Target

a3548bcea0290e9eb2102b71ed47dcd4.dll
Size

193KB
MD5

a3548bcea0290e9eb2102b71ed47dcd4
SHA1

0e2af8c0cee3b7e8266ce0fbf2829dff8795d880
SHA256

6bbe905cefacb0f2cfa7069e044b5f350de27ea15f0e9e4d9597192fa0ec91e5
SHA512

b085dd985598a79c879578003b603ef56b1bd551b189cf332ae653574acc95e0d7e487a196b0f9fe72bd5dde285e0f9939e7641958a5c58be0cd48bcbc3c6849
SSDEEP

3072:qp4jRcVu29j5Law8xUEPjxzNWnIWjSIs4c5EnOo9FoPWHOrLqlXDh8oDtqRjw3Xn:sCR49VLaw8xUEbxzyNJ9FCoDtqkXS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 644	2700	rundll32.exe	86
PID 2700 wrote to memory of 644	2700	rundll32.exe	86
PID 2700 wrote to memory of 644	2700	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3548bcea0290e9eb2102b71ed47dcd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3548bcea0290e9eb2102b71ed47dcd4.dll,#1
  2⤵
  PID:644