a6a05600691005260164b085e84f9f0aae89ca542d9f6f74904854e10220b0ff

Analysis

max time kernel
149s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 22:15

Target

a6a05600691005260164b085e84f9f0aae89ca542d9f6f74904854e10220b0ff.dll
Size

59KB
MD5

5f52bd5821a363f8ede943b854063cd0
SHA1

3749ca7db95e3e5428e34be7e418a3afe041e172
SHA256

a6a05600691005260164b085e84f9f0aae89ca542d9f6f74904854e10220b0ff
SHA512

629d2e04bbabe7394b91e8329cdc7cbae9cd66499ae88731456f1b08b49e9f65ca9fc0f069d2b1d497718b046a43842ebf74caf70ac56caaddc2a18d4fe466ca
SSDEEP

768:hu1GWc46fnDn9/M7H/FzyEEiOty2RkxInP:gwdnzTiyLkxQP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 316	212	rundll32.exe	82
PID 212 wrote to memory of 316	212	rundll32.exe	82
PID 212 wrote to memory of 316	212	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6a05600691005260164b085e84f9f0aae89ca542d9f6f74904854e10220b0ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6a05600691005260164b085e84f9f0aae89ca542d9f6f74904854e10220b0ff.dll,#1
  2⤵
  PID:316