c6a9be1854c00728f74a45a55067d1b93ac9a397e2b57e5dd683e40d8cd115c4

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 15:51

Target

c6a9be1854c00728f74a45a55067d1b93ac9a397e2b57e5dd683e40d8cd115c4.dll
Size

117KB
MD5

6d69f735584ba043fc4911760565d081
SHA1

6f3245b581a35fc0fbb423eb9cab68d45e7afda5
SHA256

c6a9be1854c00728f74a45a55067d1b93ac9a397e2b57e5dd683e40d8cd115c4
SHA512

87f19622fa132b94ca331e4dcdebb4b6e89335aa9fed734752997f9bfa3569b17c0794766d5c694505b327edd9c2991b4f4b0e7610c19f932b65c5898e2138f1
SSDEEP

1536:Eh1T6DE3TEYkJUplt8O5kfsU5vxsvqZBmzqonaGAhozR5HnXAj/J:EfEYkJ+5Uz5v6vzRTAWPHwj/J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2028	856	rundll32.exe	82
PID 856 wrote to memory of 2028	856	rundll32.exe	82
PID 856 wrote to memory of 2028	856	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6a9be1854c00728f74a45a55067d1b93ac9a397e2b57e5dd683e40d8cd115c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6a9be1854c00728f74a45a55067d1b93ac9a397e2b57e5dd683e40d8cd115c4.dll,#1
  2⤵
  PID:2028