6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 22:34

Target

6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405.dll
Size

7KB
MD5

89cefd5ee9aab44447f32746b63ea74a
SHA1

06ef848b2a89b14ac03b424ab15612b5edcf37d3
SHA256

6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405
SHA512

510591b76fde425fc49c4acd52fc37d20f37f055b5eaea10d796d4dd1688fb30f20a9b66508c8924af1f67fbbb10fa23ad411fff58a51ec1fddecc952954ccda
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW8bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPyq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2400	3016	rundll32.exe	28
PID 3016 wrote to memory of 2400	3016	rundll32.exe	28
PID 3016 wrote to memory of 2400	3016	rundll32.exe	28
PID 3016 wrote to memory of 2400	3016	rundll32.exe	28
PID 3016 wrote to memory of 2400	3016	rundll32.exe	28
PID 3016 wrote to memory of 2400	3016	rundll32.exe	28
PID 3016 wrote to memory of 2400	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405.dll,#1
  2⤵
  PID:2400