b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 00:17

Target

b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8.dll
Size

6KB
MD5

98d995b64f6cfc0547703cb60b2c4ab8
SHA1

4230455ade436a3800008b8c7364f3d341609b57
SHA256

b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8
SHA512

fc6c46c0b3b4e6b57635b896602d5b792aaf88e47ed3774d799b0ea3ff1aecbc972fc892d9a45f25ff56b8e35ae28c0882ce31efa2810259d493ed01511c18b8
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0NB+BDq9J5SH:VDa9VUX9bQWtB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3012	3232	rundll32.exe	85
PID 3232 wrote to memory of 3012	3232	rundll32.exe	85
PID 3232 wrote to memory of 3012	3232	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e3c07e0fce180b1a649e47ee218dfba801b3671db9b31aa89418698e8005f8.dll,#1
  2⤵
  PID:3012