ff6fbdaba2683c10f11274e2765f0f3a280374551d6f5d3f2c41c1d0d535a8bd

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 05:16

Target
ff6fbdaba2683c10f11274e2765f0f3a280374551d6f5d3f2c41c1d0d535a8bd.dll
Size 327KB
Sample240526-fyb2nsha86
SHA256 ff6fbdaba2683c10f11274e2765f0f3a280374551d6f5d3f2c41c1d0d535a8bd
MD5 28fd0ccd65731769292e3ab54a562c0f
SHA1 af243cc380cce8f27486d7780591e49952a2ca67
SHA512 26f9c87007439d341c31a0eeaa9f4de1140cce56ae2eb546e5a9efa98ea782e1dc91947aa6f50bdd5a7c6df049e21dd43a1958f8a4bb7381b51711c88c851046
SSDEEP 6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4644	3724	rundll32.exe	83
PID 3724 wrote to memory of 4644	3724	rundll32.exe	83
PID 3724 wrote to memory of 4644	3724	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff6fbdaba2683c10f11274e2765f0f3a280374551d6f5d3f2c41c1d0d535a8bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff6fbdaba2683c10f11274e2765f0f3a280374551d6f5d3f2c41c1d0d535a8bd.dll,#1
  2⤵
  PID:4644