6b3918dc8505625b1863379c1761c356d5fc19b5c51cd097260f3e90894dee26

Analysis

max time kernel
156s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 06:59

Target

6b3918dc8505625b1863379c1761c356d5fc19b5c51cd097260f3e90894dee26.dll
Size

492KB
MD5

d20cd238d4a70eb0b9adceade47bb65b
SHA1

cbe38ce78a75b4a2b83c99874054aa11d034ba8f
SHA256

6b3918dc8505625b1863379c1761c356d5fc19b5c51cd097260f3e90894dee26
SHA512

e5fa7670ce18bfe189fd1631091977797223ab41dbf91e051fd6f2bf9b9dcce289904549075ac07263fdbcb0911d118118112f6bb0de2cbe31fd794ea68ca196
SSDEEP

12288:HOTSbGbeNeoPMT+BWamiZxq/aml7QUYJDQCp7:uGS8eoMiZxdmlY1QC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4696	4776	rundll32.exe	81
PID 4776 wrote to memory of 4696	4776	rundll32.exe	81
PID 4776 wrote to memory of 4696	4776	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b3918dc8505625b1863379c1761c356d5fc19b5c51cd097260f3e90894dee26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b3918dc8505625b1863379c1761c356d5fc19b5c51cd097260f3e90894dee26.dll,#1
  2⤵
  PID:4696