6168f2bd5b82e5bd36fd74db17d0a600675297cc8af8116270d757188f4da854

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 17:20

Target

c6729519147dd5fa64fc621e0e0867a1.dll
Size

368KB
MD5

c6729519147dd5fa64fc621e0e0867a1
SHA1

723af5f224cd7435ed6580e53ce43a6cc479770d
SHA256

6168f2bd5b82e5bd36fd74db17d0a600675297cc8af8116270d757188f4da854
SHA512

e26578a1ec6a61cab460b8aa61576ece93dd71090ff332ecb94992c2afea210bcfa6e4d6572cb1dd784d151e2d240576eff3c60a5def3632f9adbc16a2213236
SSDEEP

6144:9Xi9jNdUIfhr6nLuwTcmhCfIJ9wHtMsr08/1iKe3FZ2yOHlFg0Dn6TJCAzgvLtlW:pi9jNdU8r6nLuMNwH2S1k6hmJ4LtlG4B

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2696	4824	rundll32.exe	88
PID 4824 wrote to memory of 2696	4824	rundll32.exe	88
PID 4824 wrote to memory of 2696	4824	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6729519147dd5fa64fc621e0e0867a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6729519147dd5fa64fc621e0e0867a1.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2696

memory/2696-0-0x0000000002810000-0x0000000002910000-memory.dmp

Filesize
1024KB

Download
memory/2696-1-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download