6f12b78a3f86b3863f830248931908c5fcabef5e58648b788b223e888d596c04

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 13:20

Target

bbe9456952bed3783df157e00d844904.dll
Size

38KB
MD5

bbe9456952bed3783df157e00d844904
SHA1

2bfdfa2cb35be35aaa4d2b6c5b4e127e87ababfd
SHA256

6f12b78a3f86b3863f830248931908c5fcabef5e58648b788b223e888d596c04
SHA512

1e2ecef65aa1f775ccb1bc4de4a158e0a909368624ce5939befce30e592eeaca3da2922fb59a6704e9a12a5683de8e7522de9555ca7681f6a2444f39c29fa183
SSDEEP

768:Lt2YH5sl4woC/8ehij9al+72frDXNSGijYRDtF3bw:Zj5sl0CphijQg72frsLYRDtFLw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3092	2100	rundll32.exe	89
PID 2100 wrote to memory of 3092	2100	rundll32.exe	89
PID 2100 wrote to memory of 3092	2100	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbe9456952bed3783df157e00d844904.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbe9456952bed3783df157e00d844904.dll,#1
  2⤵
  PID:3092