1abc1cf4406877234f5a1c2f27ff7f842c20cb3a2182c6da66e3ca5b160d13b2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:08

Target
1abc1cf4406877234f5a1c2f27ff7f842c20cb3a2182c6da66e3ca5b160d13b2.dll
Size 6KB
Sample240601-xtck3scg83
SHA256 1abc1cf4406877234f5a1c2f27ff7f842c20cb3a2182c6da66e3ca5b160d13b2
MD5 9f3af12b0f102da573415ab6324edb71
SHA1 d7ed001f5ef78dfacf58938b8eaa137faf66530d
SHA512 3eae772170b72af341a7917b156ee620d0c47fe3bcccee5a9377556720b23d1a4211594c25320d0b5cdd7a0638bf3b349485d59138646e041c9c8bfdae403c6e
SSDEEP 96:DixZjmjtjd8jPjcZGR5TIRJmipv67JFiARqvuuOysXm8rK:unSR6bgYSJmiF67ieKuuOysXmeK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2660	264	rundll32.exe	83
PID 264 wrote to memory of 2660	264	rundll32.exe	83
PID 264 wrote to memory of 2660	264	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1abc1cf4406877234f5a1c2f27ff7f842c20cb3a2182c6da66e3ca5b160d13b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1abc1cf4406877234f5a1c2f27ff7f842c20cb3a2182c6da66e3ca5b160d13b2.dll,#1
  2⤵
  PID:2660