6a66076396c7220e7e71aa6105ab6c2f9a3f9e5238253db4dc1dba608fe19ed1

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:37

Target

6a66076396c7220e7e71aa6105ab6c2f9a3f9e5238253db4dc1dba608fe19ed1.dll
Size

5KB
MD5

f1d40f3a6272c46602b0cbed898732ed
SHA1

b07634ca25c2e1893a192f6865742af88394f880
SHA256

6a66076396c7220e7e71aa6105ab6c2f9a3f9e5238253db4dc1dba608fe19ed1
SHA512

c4754566736a06c52f242cb504a5cf9406cbaf51bfc440a0283fbff431acf94826e9c8bf8eda3411386433ae84fe252ca35c458f9cdb95af04f77a9e6c3414e3
SSDEEP

96:hy859x0P8MaZt4ZQX3OAa6Kd2KqHs+LAB:F5oLO+RACdLG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3712	1868	rundll32.exe	83
PID 1868 wrote to memory of 3712	1868	rundll32.exe	83
PID 1868 wrote to memory of 3712	1868	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a66076396c7220e7e71aa6105ab6c2f9a3f9e5238253db4dc1dba608fe19ed1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a66076396c7220e7e71aa6105ab6c2f9a3f9e5238253db4dc1dba608fe19ed1.dll,#1
  2⤵
  PID:3712