3ec0c8f8c50347a654493261519cb46eb716ff0a3c9fc981a83ae5a7c2f46f39

Analysis

max time kernel
144s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:40

Target

3ec0c8f8c50347a654493261519cb46eb716ff0a3c9fc981a83ae5a7c2f46f39.dll
Size

6KB
MD5

4ec1db62fb4b5af02e45757953c71c6d
SHA1

8305e8242bbab2010d6b7d79267fe05c081afc1d
SHA256

3ec0c8f8c50347a654493261519cb46eb716ff0a3c9fc981a83ae5a7c2f46f39
SHA512

5cd0c216c569ac484ac4a52039f63ab28d289c2b0495a79d31f18fe8afe9977f67b52eba632cbd9245ce54b81063742dd67042fcda856d5ff0efdb0b89dbd004
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7QI:nGTWJGp0UZUd6378snt7QI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1660	4316	rundll32.exe	84
PID 4316 wrote to memory of 1660	4316	rundll32.exe	84
PID 4316 wrote to memory of 1660	4316	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec0c8f8c50347a654493261519cb46eb716ff0a3c9fc981a83ae5a7c2f46f39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec0c8f8c50347a654493261519cb46eb716ff0a3c9fc981a83ae5a7c2f46f39.dll,#1
  2⤵
  PID:1660