f54c13b1ac1d0660ad928122850dab7c042d764fc0580a706a692a9ea77eaa55

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 04:28

Target

f54c13b1ac1d0660ad928122850dab7c042d764fc0580a706a692a9ea77eaa55.dll
Size

6KB
MD5

fb051f057e4d79f0f553d1d550c9cef7
SHA1

ad3274cf335e4777b6de0f4de0474ea473689433
SHA256

f54c13b1ac1d0660ad928122850dab7c042d764fc0580a706a692a9ea77eaa55
SHA512

ad19b24c302240bb44a6698264653b0817ad18501a9f25d6b0a9743d7be23d168f3829ce62f52f1a93687451fd2d944d611f6b4d94c47f0def0fe45f9aa0170c
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10yB+BDq9J5SV3DY:CSVVEPozmB7QB+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1820	1740	rundll32.exe	84
PID 1740 wrote to memory of 1820	1740	rundll32.exe	84
PID 1740 wrote to memory of 1820	1740	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f54c13b1ac1d0660ad928122850dab7c042d764fc0580a706a692a9ea77eaa55.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f54c13b1ac1d0660ad928122850dab7c042d764fc0580a706a692a9ea77eaa55.dll,#1
  2⤵
  PID:1820