d6776cd83926e0d4f22dc0dde2336ee46d8fc0e1e896d0ccfa85162d7719f5a7

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:24

Target
d6776cd83926e0d4f22dc0dde2336ee46d8fc0e1e896d0ccfa85162d7719f5a7.dll
Size 6KB
Sample240405-bsjr4sha28
SHA256 d6776cd83926e0d4f22dc0dde2336ee46d8fc0e1e896d0ccfa85162d7719f5a7
MD5 32a5e13ccc7f48da940e601a315b9cad
SHA1 1bcbeda7701f1d42fdd8686b8af4e615e4fbe8c8
SHA512 50d0cd6b8c4e319fc9a5445d7498c08ef78b5b5a72caa1f409179082c7f79b83f723edd95e829b9652bba08f556b692a0b5b38864ae8a39593701b52fc306b68
SSDEEP 48:6DOdd5YVOiFVE/y/sqwokyJyi0EB+BDq9J5S9:piFVE/y6okJIB+FqX5S9
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 232	4488	rundll32.exe	85
PID 4488 wrote to memory of 232	4488	rundll32.exe	85
PID 4488 wrote to memory of 232	4488	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6776cd83926e0d4f22dc0dde2336ee46d8fc0e1e896d0ccfa85162d7719f5a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6776cd83926e0d4f22dc0dde2336ee46d8fc0e1e896d0ccfa85162d7719f5a7.dll,#1
  2⤵
  PID:232