6b8785d7d3dc581d1cfa19fbcd2b9fd11a914be94a85692f5c78b3984a1ce027

Analysis

max time kernel
437s
max time network
441s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 20:11

Target

$PROGRAMFILES/RocketDock/RocketDock.dll
Size

68KB
MD5

4a2a05b25df4385f5aec6f07b1c1e93d
SHA1

d9c05e1960a61775f1ea7849064140c2becaf5ea
SHA256

66704ce3eb7e723ba20d1ab7036ad0ba9e0a94261b7e66636b01dc76defedb9d
SHA512

f1694ff27da2af33f6e8bda40dee62c5af29d1c46aa857cee6d5bd04c7ee3f25f7c0815b335f2e62ebb7b47f79ed879512c20c2ba7ae28bb03cd88069fb9533d
SSDEEP

768:6xkqQ9idHmOCOZG0EW9m1FLqvWd9UqNXPZPrL01JsnjhB9C3fRNyRN:6rhCOZEX14v6NBzL01Ob9gRN6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4692	1468	rundll32.exe	84
PID 1468 wrote to memory of 4692	1468	rundll32.exe	84
PID 1468 wrote to memory of 4692	1468	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RocketDock\RocketDock.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RocketDock\RocketDock.dll,#1
  2⤵
  PID:4692