b16a6cc6a804b9467af86324b0c93f4e537ee52b9d08912e8d3c64abef7b6da9

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 03:49

Target

b16a6cc6a804b9467af86324b0c93f4e537ee52b9d08912e8d3c64abef7b6da9.dll
Size

72KB
MD5

37d44a02d99176d49f488378aac57490
SHA1

040a147069a43b48caa03c09d5e9874a2ad0886e
SHA256

b16a6cc6a804b9467af86324b0c93f4e537ee52b9d08912e8d3c64abef7b6da9
SHA512

a188cf9eca1f20b0581448a83826ce8ef47d14b5098f71c14a04e2ecfa2013eb01e10723bb8a052bdd6780cd733d51f9c0cec51369321adb66fc28302654af80
SSDEEP

1536:agF0eiyUcbuBo5saaRUVjAfUzfw84o9QoJ8zV0MLUt0:t2yFS3qtAfUzw1S8Z0Mh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 636	3404	rundll32.exe	81
PID 3404 wrote to memory of 636	3404	rundll32.exe	81
PID 3404 wrote to memory of 636	3404	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16a6cc6a804b9467af86324b0c93f4e537ee52b9d08912e8d3c64abef7b6da9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16a6cc6a804b9467af86324b0c93f4e537ee52b9d08912e8d3c64abef7b6da9.dll,#1
  2⤵
  PID:636