06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 14:26

Target

06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431.dll
Size

336KB
MD5

0524e24099f35adaba74258ec1de60ce
SHA1

b6f43afed6560340a8fdfa189b7bb81cf55387f8
SHA256

06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431
SHA512

2b2cebb8eb5f9552bce0c4d2ba9cff54d77e210486578fb33ce93a6c786152d868cab92dc2f987e2ee4c7d7caa9e64956b489353225830ef929513c3277776e9
SSDEEP

6144:Ad86NSG8Y3cIb3tUx8iSm+EEM2E1lwd6zn/SWGF:Ad1NSG8cbb3Ox8iyo1lwtF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 676	4752	rundll32.exe	82
PID 4752 wrote to memory of 676	4752	rundll32.exe	82
PID 4752 wrote to memory of 676	4752	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06eba5a3bf47e0afdaf938f4e9792a4bf21749371be85c66a6cffab8b7e51431.dll,#1
  2⤵
  PID:676