6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325

Analysis

max time kernel
90s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 20:04

Target

6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325.dll
Size

212KB
MD5

8f7c533e0d5c0dd8f8145fbcf8f8dd97
SHA1

cdf0325b0bfd454cae591907c62e815aeeb60500
SHA256

6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325
SHA512

7f46454cbb4ee1778a74a42b082827da65a9c26fe9e7148d1a29fee870daa209bec6070de2221e6196519e2343104633b1ddbb08399aa526deb638880f88d9f4
SSDEEP

3072:geabaFQGzCrkYBpM3PcTVBwZB8z3n3G+jcmNrW65uxIoPNH37x7OOL9:9abaFQUFYEETVBkAX3G7J7xaOh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4900	3852	rundll32.exe	82
PID 3852 wrote to memory of 4900	3852	rundll32.exe	82
PID 3852 wrote to memory of 4900	3852	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cb2fa7af36c01c870be2e4de00b26947b48eecdad92bd7f91ba04e370dc5325.dll,#1
  2⤵
  PID:4900

memory/4900-133-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download