60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 20:21

Target

60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577.dll
Size

172KB
MD5

0eff937777f5a44e2a88c442d9b4f0a3
SHA1

8cdea53a53bc88632c14cb6b34e704c714901704
SHA256

60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577
SHA512

3c5d2d683887822034adeae8e58d65b442add32d9f764047258533314676f31979955675d1bf78c4d16026d0c49669fe448e92ede32a3fb77b5dfb4c8b466952
SSDEEP

3072:zG/3vn1wVgA3GMBwHOg5PPjzz6LWij2jbZC8pHAhtJctgi:C/3t0GrHOg5jzMWHU8pgKtg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4940	4928	rundll32.exe	82
PID 4928 wrote to memory of 4940	4928	rundll32.exe	82
PID 4928 wrote to memory of 4940	4928	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577.dll,#1
  2⤵
  PID:4940