6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61

Analysis

max time kernel
172s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:12

Target

6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61.dll
Size

137KB
MD5

240ec9e39dff4617568f3d1c8adad9b0
SHA1

27a59ddc11548aaf55f451459b6a78ae47bcfdd0
SHA256

6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61
SHA512

07d458dceaadd261120d560704163a0b13a1d371d62282446f0256e056664770c8003d9d18ae0f1efad3891037313fed7225f213b663af8797a898a29aef613c
SSDEEP

3072:q8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXxn0ILV:q8w6D4Kotup0LWI+fn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2628	2456	rundll32.exe	81
PID 2456 wrote to memory of 2628	2456	rundll32.exe	81
PID 2456 wrote to memory of 2628	2456	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4ffd31e06e44249969bdbbfad6e4419499fe2d9459f162d47124e44e883e61.dll,#1
  2⤵
  PID:2628

memory/2628-133-0x0000000001F70000-0x0000000001F9B000-memory.dmp

Filesize
172KB

Download