6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712

Analysis

max time kernel
146s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 00:16

Target

6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712.dll
Size

109KB
MD5

62d6242c7db6c7d0970a68bee3d55a72
SHA1

3a8ae92ea2a9399510395431d93db0c636ca3f9b
SHA256

6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712
SHA512

04daa131616c221dbc91d7725240418c43aebdbd18c84a54f7664778afc1c86075b01ac86596b1299ee7a958174a11b41f3650cd4b8f92380a5caac1d2a2331a
SSDEEP

1536:cmfbFBKxnBbnErvv8hRfxNZVsreWdCMALOtw4ly/9FTgo9uxAc7sDh4+WMaiCq:jZQxnEgNZSmMAnRNuxfsDh4+s0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4844	4320	rundll32.exe	78
PID 4320 wrote to memory of 4844	4320	rundll32.exe	78
PID 4320 wrote to memory of 4844	4320	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c54468388d4198bfb5151370e33f30b4ea9dac2580b9a9837070619a6756712.dll,#1
  2⤵
  PID:4844