6a6b5103ae7034d906aeddcecf1a65f64d1906a818cd289cc136e31a1a81c299

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 00:24

Target

6a6b5103ae7034d906aeddcecf1a65f64d1906a818cd289cc136e31a1a81c299.dll
Size

81KB
MD5

d74694edf141da3f60b1e645c0ef758e
SHA1

bf48c56a048c1e02ac7005c50027468e4827eb4b
SHA256

6a6b5103ae7034d906aeddcecf1a65f64d1906a818cd289cc136e31a1a81c299
SHA512

d32ad994a2ff07507c47e3d2d08e0cdb18106778174b806f135369dad7425418750c856f6e5bb984feba1630bb890a8c6ef0ef8a789953b04ec3e13416eec9a9
SSDEEP

1536:+ByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8We:/v4JKXTx71wnArSsXFpeXq8We

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2552	2868	rundll32.exe	28
PID 2868 wrote to memory of 2552	2868	rundll32.exe	28
PID 2868 wrote to memory of 2552	2868	rundll32.exe	28
PID 2868 wrote to memory of 2552	2868	rundll32.exe	28
PID 2868 wrote to memory of 2552	2868	rundll32.exe	28
PID 2868 wrote to memory of 2552	2868	rundll32.exe	28
PID 2868 wrote to memory of 2552	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6b5103ae7034d906aeddcecf1a65f64d1906a818cd289cc136e31a1a81c299.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6b5103ae7034d906aeddcecf1a65f64d1906a818cd289cc136e31a1a81c299.dll,#1
  2⤵
  PID:2552