6d5210648a3794fc6fb778a8a728ea6ccde58b9055d9602590caa06788349802

Analysis

max time kernel
95s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 09:22

Target

6d5210648a3794fc6fb778a8a728ea6ccde58b9055d9602590caa06788349802.dll
Size

48KB
MD5

67dc9556f435a910fad45e315a2b1f42
SHA1

4f5e808df325fe110f5a7db408631bcc211ecf69
SHA256

6d5210648a3794fc6fb778a8a728ea6ccde58b9055d9602590caa06788349802
SHA512

44fffc892e0bc3bda89ca494b98f21db1b4ac0f1e3906a5b575f5b6196ce6fbded1be55e793b308f1cc2cf1a758fa31e96ec9452907a9c5911a482e6c6f14ae7
SSDEEP

768:ErM4DOpmWDxE6FaDq6xu4O+59ZMySSXo9888:kDOpmWDm6cDqmu4znZjboe5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2748	2288	rundll32.exe	81
PID 2288 wrote to memory of 2748	2288	rundll32.exe	81
PID 2288 wrote to memory of 2748	2288	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5210648a3794fc6fb778a8a728ea6ccde58b9055d9602590caa06788349802.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d5210648a3794fc6fb778a8a728ea6ccde58b9055d9602590caa06788349802.dll,#1
  2⤵
  PID:2748

memory/2748-133-0x0000000001FE0000-0x00000000020B6000-memory.dmp

Filesize
856KB

Download