6c29d3e252860459c687ab433a601393d993b3fe79f28c42c55921e909cd1356

Analysis

max time kernel
129s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:18

Target

6c29d3e252860459c687ab433a601393d993b3fe79f28c42c55921e909cd1356.dll
Size

727KB
MD5

93811a3c4ca3d8cef55bcf050bf2bfff
SHA1

e7544da4ce999cbabea216ab1c236fc971eae0c5
SHA256

6c29d3e252860459c687ab433a601393d993b3fe79f28c42c55921e909cd1356
SHA512

983787c0e165aca61f85ba88d3a64401fb32312b47be63f3ee89584ba21ce7ebcce11d3ab07042c913f96e1697b07f0f5951517a21d8c5e4ab67f5fb713b53f6
SSDEEP

12288:ibqC6weGZc1FFomvt8nnGJ1rJvTQNTxypFJZjiLKOg8zi:9GZeFxvtl31zpFJZSS8m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1968 wrote to memory of 4600	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 4600	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 4600	1968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c29d3e252860459c687ab433a601393d993b3fe79f28c42c55921e909cd1356.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c29d3e252860459c687ab433a601393d993b3fe79f28c42c55921e909cd1356.dll,#1
2⤵
PID:4600

memory/4600-0-0x0000000010000000-0x00000000100E1000-memory.dmp

Filesize
900KB

Download