6fe3437a8a5b217832bc5a91332508fe4bbaf8d93fbbae10a22939b2684998ff

Analysis

max time kernel
132s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:42

Target

6fe3437a8a5b217832bc5a91332508fe4bbaf8d93fbbae10a22939b2684998ff.dll
Size

81KB
MD5

38d040ab837da01aeab2c571d03dde30
SHA1

6f3851d76061d595318892c1fcf48538af3d9189
SHA256

6fe3437a8a5b217832bc5a91332508fe4bbaf8d93fbbae10a22939b2684998ff
SHA512

4f3c5c1e7438578490fa9b55157c759223c69bd641f5e78e31855c2ac0eb242cf7ea23b6157e87c3e7848c55bb88dab1ccd1501679d57a687225cef5659825e2
SSDEEP

1536:zByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wh:Cv4JKXTx71wnArSsXFpeXq8Wh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1240 wrote to memory of 1940	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1940	1240	rundll32.exe	rundll32.exe
PID 1240 wrote to memory of 1940	1240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fe3437a8a5b217832bc5a91332508fe4bbaf8d93fbbae10a22939b2684998ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fe3437a8a5b217832bc5a91332508fe4bbaf8d93fbbae10a22939b2684998ff.dll,#1
2⤵
PID:1940