8b1bbd69b9386665009316baf4222c4cbd8414720f8b663b8c143024b1e5af8a

Analysis

max time kernel
88s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 23:56

Target

8b1bbd69b9386665009316baf4222c4cbd8414720f8b663b8c143024b1e5af8a.dll
Size

6KB
MD5

26985e2f85087d8f4c8eff739f19752a
SHA1

bf0e8f9a8df57b56e7bd2d50bed5b3dd3ff2f64b
SHA256

8b1bbd69b9386665009316baf4222c4cbd8414720f8b663b8c143024b1e5af8a
SHA512

0b616bfc9433d785666666ea66e3940607379a7ece6d50df26fc73fb8d9bf16f827df9023278f977b2ecdbd7423186480188d1d644a8268b7be6197badd04f12
SSDEEP

96:nEY2RrF1eqwi4CnzbWnc7PGa801VX+GlWK5FEmuTpPB+4Goc:EHRh1eppPcLX80zX+GEo4G/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3700	4988	rundll32.exe	87
PID 4988 wrote to memory of 3700	4988	rundll32.exe	87
PID 4988 wrote to memory of 3700	4988	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b1bbd69b9386665009316baf4222c4cbd8414720f8b663b8c143024b1e5af8a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b1bbd69b9386665009316baf4222c4cbd8414720f8b663b8c143024b1e5af8a.dll,#1
  2⤵
  PID:3700