6395444e13e78924db0d35b074489b8ee9a11ca089abe4b8b4d36d920f4e4bff

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 22:02

Target

6395444e13e78924db0d35b074489b8ee9a11ca089abe4b8b4d36d920f4e4bff.dll
Size

45KB
MD5

d378d56de865b1b3a10474605aa64fd5
SHA1

1b1c7b98d741e52c190c656e46607117ff2e628f
SHA256

6395444e13e78924db0d35b074489b8ee9a11ca089abe4b8b4d36d920f4e4bff
SHA512

e2b95e27708d71d1ca58d459d9b2f653690c2d841323ce22b99e8e4473456a012f42f639cf379f33ade26bd55f9a31ebff56e1e511057b9ca1dd0b3f82faa474
SSDEEP

768:BcHEg0Qn2FJFV2/b7PhwAYMn9JnePRkEpYinAMxjRYiZUjgAMxkE054t:Bu2XT2/RfnbnePr7Hx97KuxY5o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 5044	2448	rundll32.exe	81
PID 2448 wrote to memory of 5044	2448	rundll32.exe	81
PID 2448 wrote to memory of 5044	2448	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6395444e13e78924db0d35b074489b8ee9a11ca089abe4b8b4d36d920f4e4bff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6395444e13e78924db0d35b074489b8ee9a11ca089abe4b8b4d36d920f4e4bff.dll,#1
  2⤵
  PID:5044