b6d942c0bdfeee6cfc74241c333969b16a2a96b70621b6b3a877ee9e9ae58a47

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 00:57

Target

b6d942c0bdfeee6cfc74241c333969b16a2a96b70621b6b3a877ee9e9ae58a47.dll
Size

156KB
MD5

ab7e5abcb49f736e768c0a371779fcc6
SHA1

24b1a4e5189ac0192e566ea7e2b905d2a9a4dd7b
SHA256

b6d942c0bdfeee6cfc74241c333969b16a2a96b70621b6b3a877ee9e9ae58a47
SHA512

fef9c9a0b77184ed3646fb23c9ff9ffe2876be3571f464d0c8d82727913a95438673e476f6183811b657349675e9fe0ca2bb8af39d3c3f113440910d68b1c76e
SSDEEP

3072:7bJGwLp9GijrYbFldW6RdYmzyaRlWKV4KYgMKctgX3eeP:PJbLfGiXCW65NWPTKctgHe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 3916	1932	rundll32.exe	88
PID 1932 wrote to memory of 3916	1932	rundll32.exe	88
PID 1932 wrote to memory of 3916	1932	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d942c0bdfeee6cfc74241c333969b16a2a96b70621b6b3a877ee9e9ae58a47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d942c0bdfeee6cfc74241c333969b16a2a96b70621b6b3a877ee9e9ae58a47.dll,#1
  2⤵
  PID:3916