b902609cda874998780d3ba66b326ec8b7b0861df1867bb0aadff0c3f6b8cb22

Analysis

max time kernel
93s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 01:37

Target

b902609cda874998780d3ba66b326ec8b7b0861df1867bb0aadff0c3f6b8cb22.dll
Size

81KB
MD5

6035a56ba59801dbc5c9b4f4793d9004
SHA1

893d4525aa3cb3805b77a9e435b236f6f863ca11
SHA256

b902609cda874998780d3ba66b326ec8b7b0861df1867bb0aadff0c3f6b8cb22
SHA512

77d3b56e4a6a2df7ae32005c072486cba80e22e45180c14930f2265bc87fb68b230e82922f0ca1902e932fb158ec5913cbffb049d5735bf3e1ecef480ce0e33b
SSDEEP

1536:JtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wd:J4v4JKXTx71w0ArSsXF3enq8Wd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 3364	4728	rundll32.exe	82
PID 4728 wrote to memory of 3364	4728	rundll32.exe	82
PID 4728 wrote to memory of 3364	4728	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b902609cda874998780d3ba66b326ec8b7b0861df1867bb0aadff0c3f6b8cb22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b902609cda874998780d3ba66b326ec8b7b0861df1867bb0aadff0c3f6b8cb22.dll,#1
  2⤵
  PID:3364