6cb4392f9458ad03c365cb77097121ac21d1a159fa77bc2cbd2b18cac99f0e3c

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 22:15

Target

6cb4392f9458ad03c365cb77097121ac21d1a159fa77bc2cbd2b18cac99f0e3c.dll
Size

1.2MB
MD5

4453f0ac7ffb5ca593eca7985b1b0548
SHA1

9fff262aa23d10fb3e9a349b113d2d8e6c85d3f3
SHA256

6cb4392f9458ad03c365cb77097121ac21d1a159fa77bc2cbd2b18cac99f0e3c
SHA512

35b07822e8c3d731269cc0adb213ed01fd4b0f339b527d011f7da287275b0064749480735fef7b398d72a3e57a3b96006ae76c3365ce8095c7d4f59af4e7ebb2
SSDEEP

12288:+lvVOX06kOIJDaNqADGLMP6tVHb3z4IRCwRAlvBOvTOQIw2AZ8L/Dq:iOxkOoABP6t21eAlorIznL/Dq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3560	1404	rundll32.exe	82
PID 1404 wrote to memory of 3560	1404	rundll32.exe	82
PID 1404 wrote to memory of 3560	1404	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cb4392f9458ad03c365cb77097121ac21d1a159fa77bc2cbd2b18cac99f0e3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cb4392f9458ad03c365cb77097121ac21d1a159fa77bc2cbd2b18cac99f0e3c.dll,#1
  2⤵
  PID:3560