6e150666b4c3e16613eac1ecc059ac754f7b31c2ec054e2c32802d1bfaf28186

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 22:52

Target

6e150666b4c3e16613eac1ecc059ac754f7b31c2ec054e2c32802d1bfaf28186.dll
Size

6KB
MD5

64673dbfcd667651f016f746bb096095
SHA1

a7cfd1e17026887ae93ebe22dba72cff07cd3930
SHA256

6e150666b4c3e16613eac1ecc059ac754f7b31c2ec054e2c32802d1bfaf28186
SHA512

e863b4d477be4acb3714a6d068c4c2fe4e44358a09ef1065c452dc2842db223fb4eb103f6ce2c1bc3432c1f7a041ed5fc2bbddd4b3d5de6acf2dcb1ca27e23ec
SSDEEP

96:hy859x0P8Ma1ccccccNcccccfcccqccc1cccgqccSccclqqcccc8ccqqdhqqqqcx:F5oLe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1780	2280	rundll32.exe	28
PID 2280 wrote to memory of 1780	2280	rundll32.exe	28
PID 2280 wrote to memory of 1780	2280	rundll32.exe	28
PID 2280 wrote to memory of 1780	2280	rundll32.exe	28
PID 2280 wrote to memory of 1780	2280	rundll32.exe	28
PID 2280 wrote to memory of 1780	2280	rundll32.exe	28
PID 2280 wrote to memory of 1780	2280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e150666b4c3e16613eac1ecc059ac754f7b31c2ec054e2c32802d1bfaf28186.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e150666b4c3e16613eac1ecc059ac754f7b31c2ec054e2c32802d1bfaf28186.dll,#1
  2⤵
  PID:1780