6cd28ddf4c487f3866572b5ce0a04524e20f740e962a34c6694af6a16281e227

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 22:42

Target

6cd28ddf4c487f3866572b5ce0a04524e20f740e962a34c6694af6a16281e227.dll
Size

6KB
MD5

8a73ff772457323e5f47008fb5a813e3
SHA1

ba5c3d83c2bbcc1de4c7be8769c97fc2ea217089
SHA256

6cd28ddf4c487f3866572b5ce0a04524e20f740e962a34c6694af6a16281e227
SHA512

c9928f0d444788d295ef741f7c9bb139bd1279ce7761a75c4d5022f888b3c0406a472719a2b35ca542946e4e296c1bf8c03bdac74c7320804bed5d3c7726fccd
SSDEEP

96:hy859x0P8MazpyTetgEj4Wp1qVSo64tqrBKodBm:F5oLk5tgEjvfcSo6gqrBFdBm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2028	1240	rundll32.exe	28
PID 1240 wrote to memory of 2028	1240	rundll32.exe	28
PID 1240 wrote to memory of 2028	1240	rundll32.exe	28
PID 1240 wrote to memory of 2028	1240	rundll32.exe	28
PID 1240 wrote to memory of 2028	1240	rundll32.exe	28
PID 1240 wrote to memory of 2028	1240	rundll32.exe	28
PID 1240 wrote to memory of 2028	1240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cd28ddf4c487f3866572b5ce0a04524e20f740e962a34c6694af6a16281e227.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cd28ddf4c487f3866572b5ce0a04524e20f740e962a34c6694af6a16281e227.dll,#1
  2⤵
  PID:2028