106c8028a3f14fc1ed1379dcd2476945434bc7a18d680cb1678b4dad31175d53

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 18:49

Target

106c8028a3f14fc1ed1379dcd2476945434bc7a18d680cb1678b4dad31175d53.dll
Size

2.0MB
MD5

fb1439e5a6552a6fac72fd41bf44d55c
SHA1

a86aff83651a493d6a2800248a2486dfdc27a921
SHA256

106c8028a3f14fc1ed1379dcd2476945434bc7a18d680cb1678b4dad31175d53
SHA512

ddf1343f31ad9b7983c2c0421128230c7d9d67916aed5e40f2582d6301b99a0fbb9362290cc2e6b09f594419dcdd5dba42b8e5ce1c48743103ad04e1f450cf21
SSDEEP

49152:M6529/SByKKZgrns90nwezFzCHxRPWGUM4YyoMo:Mb9/SBypZgrxnwUFz8PVUM4YyK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3800	4364	rundll32.exe	81
PID 4364 wrote to memory of 3800	4364	rundll32.exe	81
PID 4364 wrote to memory of 3800	4364	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\106c8028a3f14fc1ed1379dcd2476945434bc7a18d680cb1678b4dad31175d53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\106c8028a3f14fc1ed1379dcd2476945434bc7a18d680cb1678b4dad31175d53.dll,#1
  2⤵
  PID:3800