6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 03:57

Target
6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893.dll
Size 896KB
Sample240612-ejapmazgqh
SHA256 6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893
MD5 cf40990167b416d25187e582eb6d34b1
SHA1 b0eadd4abb8aa70e8d5727e05df20fa3afe6e3ba
SHA512 ff1f346aa07871d430f095ebef21f1e7a8d258dc27ec9019d6f8580eb66f309ecbda8f440a4f421cb7017592dbac7d49c0539b2aa0bfbd61b3b0bcbc0ecc24ec
SSDEEP 12288:mFsx3BDGi6P6H0zdCvdKK5UEARIgcwhxV3cG9pbOprbEmot2lYlb2fQX0+Rk7wKo:mIDHJEmot2lYU4rkMK9LGXfQqGQ07vK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 4648	1792	rundll32.exe	79
PID 1792 wrote to memory of 4648	1792	rundll32.exe	79
PID 1792 wrote to memory of 4648	1792	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f5396109237c086e4a03b46195fd7cddaaea9eac5a775883eafd7628342c893.dll,#1
  2⤵
  PID:4648