6b5291e8a238c994ee4144298ac2702be2dd997ee4c145882d709d1664df81bc

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 21:06

Target

6b5291e8a238c994ee4144298ac2702be2dd997ee4c145882d709d1664df81bc.dll
Size

236KB
MD5

058a6fd3dc6aa266df6bb2ce9fa1c9b0
SHA1

03fe0d103c3de8f136d78ad0f06b99f400554f11
SHA256

6b5291e8a238c994ee4144298ac2702be2dd997ee4c145882d709d1664df81bc
SHA512

4452868cc26298ac8e055de7e8a2d2ff55cc816f66324cc81b09cdcff8c43f453d314f49c0fb7d30330689c34d0205786de187cbd1b900d83697772863565652
SSDEEP

3072:skUNwyLv/ENXtvHGKGP8HUSnC7My733eOc6FVK5N/43c+M9t629kJMvHHVvryTfw:skU28SGyVfwBjgK3pHMvilo1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 1040	4256	rundll32.exe	81
PID 4256 wrote to memory of 1040	4256	rundll32.exe	81
PID 4256 wrote to memory of 1040	4256	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b5291e8a238c994ee4144298ac2702be2dd997ee4c145882d709d1664df81bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b5291e8a238c994ee4144298ac2702be2dd997ee4c145882d709d1664df81bc.dll,#1
  2⤵
  PID:1040

memory/1040-133-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download