60f2469bfafb4dbbfedd7ce64aae27dfdb2ab91fe01e266e86c6a9a4814d195a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 22:19

Target

60f2469bfafb4dbbfedd7ce64aae27dfdb2ab91fe01e266e86c6a9a4814d195a.dll
Size

6KB
MD5

dd180d9d949d6a1656678966061e631f
SHA1

45eaf60c48680e86633bdcc0a06df70d7ee3d5c7
SHA256

60f2469bfafb4dbbfedd7ce64aae27dfdb2ab91fe01e266e86c6a9a4814d195a
SHA512

593060bc5b0ec1fc17507704febc2cfc6a389ecf0aa3625b747c23651f9a75be72e82e38e5bdf15f11af845ed9ec2c6121c4a3ba4247ff237847e34f0af0600c
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEq6MW+d6jbn7sAPW0YmW+kcsnW0e9WWW0u8q:hy859x0P8MaLaAAQUZgTN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1496	2004	rundll32.exe	83
PID 2004 wrote to memory of 1496	2004	rundll32.exe	83
PID 2004 wrote to memory of 1496	2004	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60f2469bfafb4dbbfedd7ce64aae27dfdb2ab91fe01e266e86c6a9a4814d195a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60f2469bfafb4dbbfedd7ce64aae27dfdb2ab91fe01e266e86c6a9a4814d195a.dll,#1
  2⤵
  PID:1496