f861324e7051eb75666ac49fe5480d376fdacc6843cbdf06af3859fc8067df22

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 02:39

Target

f861324e7051eb75666ac49fe5480d376fdacc6843cbdf06af3859fc8067df22.dll
Size

6KB
MD5

4e796b92e5e7992f7741a959020dc024
SHA1

476aa44a71d9c2a12a1ca4a006dda8ea8d0c863c
SHA256

f861324e7051eb75666ac49fe5480d376fdacc6843cbdf06af3859fc8067df22
SHA512

5448070342c976f1f4038b960993e23940ef7cb41a1e0cfe96ca6987719d5dc32514ac5320b0fbf223a6efb3dba218b0a4a3551cb674fb216d6f186b2daf6a64
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEq0+iYcD+pbehJa/O7q1ASu6:hy859x0P8MaN1cmpW7qQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1372	1696	rundll32.exe	88
PID 1696 wrote to memory of 1372	1696	rundll32.exe	88
PID 1696 wrote to memory of 1372	1696	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f861324e7051eb75666ac49fe5480d376fdacc6843cbdf06af3859fc8067df22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f861324e7051eb75666ac49fe5480d376fdacc6843cbdf06af3859fc8067df22.dll,#1
  2⤵
  PID:1372