f12f279d66d32eee84c09ba0b6a6a0792e667423a21d70d67c89660cc2a5d46a

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 18:19

Target

virussign.com_6393e45731ff7b1e29b630d9933e7030.dll
Size

131KB
MD5

6393e45731ff7b1e29b630d9933e7030
SHA1

13387cdff5d3452b4b464531e04a111b21b80eb7
SHA256

f12f279d66d32eee84c09ba0b6a6a0792e667423a21d70d67c89660cc2a5d46a
SHA512

ef2f9030c043002e344f210259fb8711d4a57c844ca4a4fc29086102de3482fd7ab9176aeb4ba67fd15e14e65cc8e625214ce5b7310d90d839978ee782645685
SSDEEP

3072:aBoQ8C6kW1yg7uOOcFA8riMnzhI2VQ2BP+ic7MV8fZZ+Ip/9:a6Q8C2l7uODO8rv1HDJcPF99

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4312	4904	rundll32.exe	83
PID 4904 wrote to memory of 4312	4904	rundll32.exe	83
PID 4904 wrote to memory of 4312	4904	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.com_6393e45731ff7b1e29b630d9933e7030.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.com_6393e45731ff7b1e29b630d9933e7030.dll,#1
  2⤵
  PID:4312