6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 22:34

Target

6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405.dll
Size

7KB
MD5

89cefd5ee9aab44447f32746b63ea74a
SHA1

06ef848b2a89b14ac03b424ab15612b5edcf37d3
SHA256

6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405
SHA512

510591b76fde425fc49c4acd52fc37d20f37f055b5eaea10d796d4dd1688fb30f20a9b66508c8924af1f67fbbb10fa23ad411fff58a51ec1fddecc952954ccda
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW8bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPyq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3200	4688	rundll32.exe	80
PID 4688 wrote to memory of 3200	4688	rundll32.exe	80
PID 4688 wrote to memory of 3200	4688	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6af0c0bb5e09602a268a59e58e51183d8dfb40985c1d12a0529da5d0def405.dll,#1
  2⤵
  PID:3200