6fb0be9ba084454cd4328c06749dcaede46fa37be1060c3ef3bdff20c9030e3e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:41

Target

6fb0be9ba084454cd4328c06749dcaede46fa37be1060c3ef3bdff20c9030e3e.dll
Size

463KB
MD5

e35eaf29afdebae737b141f43fc3af30
SHA1

ceccbdefb01529d58f3e8dc38bf8346453844aa3
SHA256

6fb0be9ba084454cd4328c06749dcaede46fa37be1060c3ef3bdff20c9030e3e
SHA512

c5745a4cb0a8f78e5f1fdcf8e280cec10638304c113d8c1252fe9dd5160580becfc90919c53c610b0b711be772d1bfb6f5ff3cc557b45fa6a6c3e0fd0a9f3720
SSDEEP

12288:o2nv8ccS8cc/Z/cs8Ccs8/y5LAr+dT4octaBjvrEH7tIfS:o2nv8ccS8cc/Z/cs8Ccs8/ynG6rEH7qK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4664 wrote to memory of 4576	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4576	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4576	4664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fb0be9ba084454cd4328c06749dcaede46fa37be1060c3ef3bdff20c9030e3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fb0be9ba084454cd4328c06749dcaede46fa37be1060c3ef3bdff20c9030e3e.dll,#1
2⤵
PID:4576