db89627ccbd77f78da2536191c0db6ed6b1cd84238320fe406944593cb2b5b24

Analysis

max time kernel
96s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:37

Target

db89627ccbd77f78da2536191c0db6ed6b1cd84238320fe406944593cb2b5b24.dll
Size

6KB
MD5

bb259c30a4e38431f6aa322a2170ae97
SHA1

316afa2534ebd0797be94f13d815e74dcb70d77e
SHA256

db89627ccbd77f78da2536191c0db6ed6b1cd84238320fe406944593cb2b5b24
SHA512

cfebd2ff85243cca6755ef9b85c0b80bff3eee6a4fa1b54bad325bdb2e0b08110743399f505c078ca7d6f0128a593b35a48c21eec8d5681772d1a9f9d4386b11
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0ECB+BDq9J5SC:8qtV0HAr4PCB+FqX5SC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3472	3244	rundll32.exe	85
PID 3244 wrote to memory of 3472	3244	rundll32.exe	85
PID 3244 wrote to memory of 3472	3244	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db89627ccbd77f78da2536191c0db6ed6b1cd84238320fe406944593cb2b5b24.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db89627ccbd77f78da2536191c0db6ed6b1cd84238320fe406944593cb2b5b24.dll,#1
  2⤵
  PID:3472