94af5ed0b1ef4fe9d484e7bb63468914cd6bf7e8b9bfad2840b994cb4766089f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 21:46

Target

c6eefdc538e035c12de9aaa7d5979d19.dll
Size

220KB
MD5

c6eefdc538e035c12de9aaa7d5979d19
SHA1

81b26b7faa1c319e5e3dd13425586e2d429340a7
SHA256

94af5ed0b1ef4fe9d484e7bb63468914cd6bf7e8b9bfad2840b994cb4766089f
SHA512

f93a19a348333f7156d9e26d7d9eafe77f39a45740ab1bfb8d6daeeba6a80decb5e70018be026ccfc094c6de2a98efa036c0658ee74f2d24eea484f615f0748c
SSDEEP

3072:NyUFm3vClsa2VWc2/8aOPYJRu1NxZElNdx6fw/RG5l4pbD:u3q6L17PYqxAdYf/+X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 4324	1736	rundll32.exe	89
PID 1736 wrote to memory of 4324	1736	rundll32.exe	89
PID 1736 wrote to memory of 4324	1736	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6eefdc538e035c12de9aaa7d5979d19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6eefdc538e035c12de9aaa7d5979d19.dll,#1
  2⤵
  PID:4324