c6e1504c22728ab2c88dc81f607feee636c1d722aa29d3bb86474714823015f6

Analysis

max time kernel
140s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 19:42

Target

c6e1504c22728ab2c88dc81f607feee636c1d722aa29d3bb86474714823015f6.dll
Size

21KB
MD5

b29a548620eb18b60e224d3cdb3f73fb
SHA1

9480d7f064d2ba3ba580cab3281f8109e8e3ee54
SHA256

c6e1504c22728ab2c88dc81f607feee636c1d722aa29d3bb86474714823015f6
SHA512

1b26acaa335803610795549eaa9ab87291c7394f552f75877777063fc72826a52547d2d8a17edba7689d175a97c610fa5f14bf3e853f3a4bf8956246c4b9ab0d
SSDEEP

384:mmphhGNn/0Iu5hdy0tmVDF4bQN+gXlGzW:3NGZ/09zW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1176	2224	rundll32.exe	14
PID 2224 wrote to memory of 1176	2224	rundll32.exe	14
PID 2224 wrote to memory of 1176	2224	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6e1504c22728ab2c88dc81f607feee636c1d722aa29d3bb86474714823015f6.dll,#1
1⤵
PID:1176

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6e1504c22728ab2c88dc81f607feee636c1d722aa29d3bb86474714823015f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

memory/1176-132-0x0000000000000000-mapping.dmp

Download
memory/1176-133-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download