68e9d9bfc5f413b0ff27daabe6fbb69dc53df904b734333992e65c3c0c4cc1e7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 23:38

Target

68e9d9bfc5f413b0ff27daabe6fbb69dc53df904b734333992e65c3c0c4cc1e7.dll
Size

5KB
MD5

7af5a85b471c4bf935a914f3abd8a032
SHA1

c3717366884483563e5b7e71eff81e06d0a7267a
SHA256

68e9d9bfc5f413b0ff27daabe6fbb69dc53df904b734333992e65c3c0c4cc1e7
SHA512

4883b6cfc19dc3520451fa09ee08da953c8a6e7e7e37b4fca54790eb7214fa6433ada486fa66b01a68e5e16814a93d0d067112bae7f525bca3eebdbda66ed968
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhU1Pbmq/OJhi/NOsyvE0ufy+/coE:nEY2RrF1eqwi4udmq2EVyc0H+E4lLJ+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3968	4400	rundll32.exe	82
PID 4400 wrote to memory of 3968	4400	rundll32.exe	82
PID 4400 wrote to memory of 3968	4400	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68e9d9bfc5f413b0ff27daabe6fbb69dc53df904b734333992e65c3c0c4cc1e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68e9d9bfc5f413b0ff27daabe6fbb69dc53df904b734333992e65c3c0c4cc1e7.dll,#1
  2⤵
  PID:3968