a6e8d320323e6b1a4123d12914bbd73c5d06f5d4110aed695071a86476d5f304

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 23:43

Target

a6e8d320323e6b1a4123d12914bbd73c5d06f5d4110aed695071a86476d5f304.dll
Size

7KB
MD5

89dcdb3906a4a618c00aeab2e1438737
SHA1

5f6d849c9f5683752885ed33d3f8c8e4d1955647
SHA256

a6e8d320323e6b1a4123d12914bbd73c5d06f5d4110aed695071a86476d5f304
SHA512

6f0356f6549d218db8fff3d7541a1ce3b008fb9d456010fe9f31af5e62b36e683e3ba55c16d7a278f05668ee02662eccd0aded6c8cad0231c010d33db54d02af
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPCd3cX5aXW:wUaJf/aFbP0O52JaX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3168	2152	rundll32.exe	85
PID 2152 wrote to memory of 3168	2152	rundll32.exe	85
PID 2152 wrote to memory of 3168	2152	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6e8d320323e6b1a4123d12914bbd73c5d06f5d4110aed695071a86476d5f304.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6e8d320323e6b1a4123d12914bbd73c5d06f5d4110aed695071a86476d5f304.dll,#1
  2⤵
  PID:3168