6292ccbea9a6acc88b2f003a2179fdab9b6cc44d65dc3c886ba0f00baa49debf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:31

Target

6292ccbea9a6acc88b2f003a2179fdab9b6cc44d65dc3c886ba0f00baa49debf.dll
Size

20KB
MD5

c524cfac024c42def141bb441ed962a0
SHA1

45405487718fa23cc469e11b0fa510d83b53c2df
SHA256

6292ccbea9a6acc88b2f003a2179fdab9b6cc44d65dc3c886ba0f00baa49debf
SHA512

58f86bd6aebe975bf7a60802912a13d2862b879cf6107e33bc1550c9606c1595e3f17849efcffcf932a4bf2055b89053013774e0f56f4fc79955c0c3c86947af
SSDEEP

384:vMdWuk7wGqWpxCCi8cakcMhdRC58jTJ03Z8Z:5J7wGF7vcacQ58Y8Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3960 wrote to memory of 1292	3960	rundll32.exe	rundll32.exe
PID 3960 wrote to memory of 1292	3960	rundll32.exe	rundll32.exe
PID 3960 wrote to memory of 1292	3960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6292ccbea9a6acc88b2f003a2179fdab9b6cc44d65dc3c886ba0f00baa49debf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6292ccbea9a6acc88b2f003a2179fdab9b6cc44d65dc3c886ba0f00baa49debf.dll,#1
2⤵
PID:1292