4060582bbb8e08b948cc9096c3d1e9f15d449476e362362139faa89917eb13b0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:29

Target

4060582bbb8e08b948cc9096c3d1e9f15d449476e362362139faa89917eb13b0.dll
Size

132KB
MD5

07cc8d7cc333783c43529642eb6f68e0
SHA1

15781365544f97ae86331f76325071144ca252a8
SHA256

4060582bbb8e08b948cc9096c3d1e9f15d449476e362362139faa89917eb13b0
SHA512

53652738c31858fb14b52391b060a278d41d470dbbfc05c077fd46652f427cda1cb55fff578e40cd1f105124b7c860453411a3aaa6478c0daf3d98a6a2dd1b7c
SSDEEP

3072:m4xLJdtZ4tzie1UJ9T80gtdNPlm98nJLl0Y6EN9:mi47V

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3104 wrote to memory of 1976	3104	rundll32.exe	rundll32.exe
PID 3104 wrote to memory of 1976	3104	rundll32.exe	rundll32.exe
PID 3104 wrote to memory of 1976	3104	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4060582bbb8e08b948cc9096c3d1e9f15d449476e362362139faa89917eb13b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4060582bbb8e08b948cc9096c3d1e9f15d449476e362362139faa89917eb13b0.dll,#1
  2⤵
  PID:1976