6c21329da011f3495ad312dd7dca3b3555059a6d9aec24eb62b9afe542e297b2

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 12:15

Target

6c21329da011f3495ad312dd7dca3b3555059a6d9aec24eb62b9afe542e297b2.dll
Size

2.4MB
MD5

24bc6f1fb27b12a48df97ca2592b88ac
SHA1

0afbce8079db7a473d2f04d8da71048e0540a027
SHA256

6c21329da011f3495ad312dd7dca3b3555059a6d9aec24eb62b9afe542e297b2
SHA512

eb4f0e8bd5f91eb96203eca476cb161378110bff91b4b2c2ec375f371a977e9c739afa78374a4456757b78d0cfce57df61df95d31e566903d5330e2ada606eb3
SSDEEP

49152:dC1gY8DnlmBFjvJxHAzmb9zxgSjEe8629UXhubAbtCqQGm/ThEBVhVptvZz:c2YHAzm5zxae8TbAbtNzm0fb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1312	1644	rundll32.exe	83
PID 1644 wrote to memory of 1312	1644	rundll32.exe	83
PID 1644 wrote to memory of 1312	1644	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c21329da011f3495ad312dd7dca3b3555059a6d9aec24eb62b9afe542e297b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c21329da011f3495ad312dd7dca3b3555059a6d9aec24eb62b9afe542e297b2.dll,#1
  2⤵
  PID:1312