6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f

Analysis

max time kernel
363s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 09:22

Target

6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f.dll
Size

203KB
MD5

2079d75ce6794ea85a093d621b757100
SHA1

6e424ec139a0980f41df86d243db7889bd9d9561
SHA256

6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f
SHA512

31d1f582edbb7885f2f2cfb3be8cafde9d73209c840ae96dd9dec963f4a57c2ed5e96fdff76b78be09ba233900324898137f7881a2e40ae1ceef44867396c52b
SSDEEP

3072:9h+2weEohlRyaBluJfu7YyrgtnQCedYjJ+XSX4deo60rwvAlt:rxXrlyaiJE5g1QlkkXSIdex0rrl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4304	2860	rundll32.exe	77
PID 2860 wrote to memory of 4304	2860	rundll32.exe	77
PID 2860 wrote to memory of 4304	2860	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dbbc9e8dfbc2a73333db557e8ddebcd6d61b1da44412d1b536194913420a04f.dll,#1
  2⤵
  PID:4304