661c24179623217c4645826302af764d4786c604a4a6c09560caa0eec4bebc83

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 22:31

Target

661c24179623217c4645826302af764d4786c604a4a6c09560caa0eec4bebc83.dll
Size

6KB
MD5

befd5f45a2d48934cea5bab9bf4c7fc2
SHA1

28d56c1eaf84b102f99d3713a7edaf3f32a1bc92
SHA256

661c24179623217c4645826302af764d4786c604a4a6c09560caa0eec4bebc83
SHA512

1520b2c095764b1f8724490a3b2866ceda1fbec2297cc9920b7b933a4bd0d1f6f65bf3c7db2971273f4791d237712a980602e70345a87f9c322d0b0a1b5c8080
SSDEEP

96:DixZjmjtjd8jPjcZGR5TID6C3E8j9QV+2eCsl1boEKVJFLkbLh:unSR6bgYm3ppI+wsl1583kJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5028	4992	rundll32.exe	82
PID 4992 wrote to memory of 5028	4992	rundll32.exe	82
PID 4992 wrote to memory of 5028	4992	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\661c24179623217c4645826302af764d4786c604a4a6c09560caa0eec4bebc83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\661c24179623217c4645826302af764d4786c604a4a6c09560caa0eec4bebc83.dll,#1
  2⤵
  PID:5028