6b8785d7d3dc581d1cfa19fbcd2b9fd11a914be94a85692f5c78b3984a1ce027

Analysis

max time kernel
433s
max time network
437s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 20:11

Target

$PROGRAMFILES/RocketDock/Docklets/RocketClock/RocketClock.dll
Size

104KB
MD5

b16f204c60bf89c8cf87de4402aa4cae
SHA1

25f96fe711f3191b1e6e4c118805c279048227f9
SHA256

ed736c6039de8fca833cede2b41474882dff2647deca3f12903bacc760864bef
SHA512

4d2841538a6b04bcc642e4766954436ae022c405d40549120e56405e7eef97372bff4d4994036327f1d41a88b816652f3b465daa4c0e8630dd9ea5c9300c03ef
SSDEEP

1536:387L3CzyGKUo5PpJMgI0QtImNxQkJ/RENLiT5UZr1:3a3COzG0dyv2NWT5Uh1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2096	4884	rundll32.exe	83
PID 4884 wrote to memory of 2096	4884	rundll32.exe	83
PID 4884 wrote to memory of 2096	4884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RocketDock\Docklets\RocketClock\RocketClock.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RocketDock\Docklets\RocketClock\RocketClock.dll,#1
  2⤵
  PID:2096