bb6fd94d088d1205ae5fe6f1b45c3a366490a1286741c0eb71f517997182f2be

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 19:55

Target
$PROGRAMFILES/RF_L/tc_Prih.dll
Size 107KB
Sample240606-ym9snscc32
SHA256 0d94db6573325be0189e4fca361d7010b062232518359ed73c2c51c057723cd6
MD5 cf3700abd3bd07e6ba075ae723d99d52
SHA1 ca4b847739e5d0eef0e95e9e3439d42fb7184644
SHA512 ad65de3c93f5e003d991778937dd29e7007efa61cf605e0bbd34b0d0bd1f192d446da58ed6e9ca877434acb94f4df23b4e238ee9db0181585e03925d37a95b5d
SSDEEP 1536:/lWZTEEcP623D6dVzfTHNn2G68n4zdHP33n2+seJJW5LlYs+nLbx3h/U:/lAEDOJbuRJNJJW5M/XU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3764	3496	rundll32.exe	82
PID 3496 wrote to memory of 3764	3496	rundll32.exe	82
PID 3496 wrote to memory of 3764	3496	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RF_L\tc_Prih.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RF_L\tc_Prih.dll,#1
  2⤵
  PID:3764