668e53a4ae2f9052012f687cae889324d3e45f945ce4c27eae58cdd2643f70e3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:54

Target

668e53a4ae2f9052012f687cae889324d3e45f945ce4c27eae58cdd2643f70e3.dll
Size

7KB
MD5

533993b0d68270880e7540a6d65ed620
SHA1

9c2e3a4e249e41494c457d348a29e740b70b7b8a
SHA256

668e53a4ae2f9052012f687cae889324d3e45f945ce4c27eae58cdd2643f70e3
SHA512

856c57074e64eb66172ad9a89862de9c332c25161dfa76d0d6ea27181b01d8396827532768cec6b7f531d7c78718182d1875ea350caa2637273380b81bb1071f
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPXd3cX5aXW:wUaJf/aFbP0Og2JaX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1396 wrote to memory of 3964	1396	rundll32.exe	rundll32.exe
PID 1396 wrote to memory of 3964	1396	rundll32.exe	rundll32.exe
PID 1396 wrote to memory of 3964	1396	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\668e53a4ae2f9052012f687cae889324d3e45f945ce4c27eae58cdd2643f70e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\668e53a4ae2f9052012f687cae889324d3e45f945ce4c27eae58cdd2643f70e3.dll,#1
2⤵
PID:3964