b86fe224a6b1f407b315daa28950d5a73a1267c5de2641b8155accd199f34963

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 01:44

Target

b86fe224a6b1f407b315daa28950d5a73a1267c5de2641b8155accd199f34963.dll
Size

6KB
MD5

29eb55beaf4b17af7176bac970505d72
SHA1

14bff24212730024723e789898cbdfdd7cf1d6ce
SHA256

b86fe224a6b1f407b315daa28950d5a73a1267c5de2641b8155accd199f34963
SHA512

3f7e104f0f05af382e1a676551ac972869f92582b1a34dde77ab8abdf306823aec37ff844e75891f795e0ce767bc7948d527e6214374743419463ce54c703db8
SSDEEP

96:nEY2RrF1eqwi4hy6gUepHo1s+UFlr5i5POvCpE7cRZgGvhq:EHRh1eppXgTpHo1n0WPO6pE7SZHv0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 5788	4616	rundll32.exe	85
PID 4616 wrote to memory of 5788	4616	rundll32.exe	85
PID 4616 wrote to memory of 5788	4616	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b86fe224a6b1f407b315daa28950d5a73a1267c5de2641b8155accd199f34963.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b86fe224a6b1f407b315daa28950d5a73a1267c5de2641b8155accd199f34963.dll,#1
  2⤵
  PID:5788