f27e2f73a99b95be6c8cd177c0284eb54a3fe502e93af7c39da0e7516f510f84

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 03:48

Target
f27e2f73a99b95be6c8cd177c0284eb54a3fe502e93af7c39da0e7516f510f84.dll
Size 6KB
Sample240409-ecq32ahb81
SHA256 f27e2f73a99b95be6c8cd177c0284eb54a3fe502e93af7c39da0e7516f510f84
MD5 d0e78ac5217961e0a8e080903b4ae935
SHA1 01ea3180838c031dde1034956df506656d84c5b6
SHA512 2a548dff98b8d76bbf82663080ea660d92dd30209ecfa7d42eaba08c8c05881aca5a737bfff3f2e1d69a29c0f14817a039c4f56253c70fcd933006238b3782ea
SSDEEP 96:hy859x0P8Ma25d5jWxXWx1VGnT5iyeGt6AJT62S0m8jI7Zr1d8bWGJnnk:F5oLzucCs0t7TVKZQbb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4824	4992	rundll32.exe	86
PID 4992 wrote to memory of 4824	4992	rundll32.exe	86
PID 4992 wrote to memory of 4824	4992	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f27e2f73a99b95be6c8cd177c0284eb54a3fe502e93af7c39da0e7516f510f84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f27e2f73a99b95be6c8cd177c0284eb54a3fe502e93af7c39da0e7516f510f84.dll,#1
  2⤵
  PID:4824