6c60ae7153ebb96b8b92b9209792a1ec57d7b334134af09af3717689dc052831

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 21:43

Target
6c60ae7153ebb96b8b92b9209792a1ec57d7b334134af09af3717689dc052831.dll
Size 6KB
Sample240404-1lb65abg87
SHA256 6c60ae7153ebb96b8b92b9209792a1ec57d7b334134af09af3717689dc052831
MD5 05dce4b0139df08f6a69bf45a228f7a9
SHA1 68803bd423f2fcf271a261730d6fa06e88672137
SHA512 bac2687b5268644f5c84690578e520a2e251c1c5ece82765e837b40f28981bd4f08f40656b95174083a011448fb20d74e67e389cdfec7a5bf3bcedad63c0007a
SSDEEP 48:6AA35YVOQDV8FszwydlAYsLFV3G0EB+BDq9J5S2:0QDV8FscMjsLFV38B+FqX5S2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3504	4380	rundll32.exe	85
PID 4380 wrote to memory of 3504	4380	rundll32.exe	85
PID 4380 wrote to memory of 3504	4380	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c60ae7153ebb96b8b92b9209792a1ec57d7b334134af09af3717689dc052831.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c60ae7153ebb96b8b92b9209792a1ec57d7b334134af09af3717689dc052831.dll,#1
  2⤵
  PID:3504