d6dad370e0a428908bddd9ff5cbd6f6895410d3083f1a005a9ee813dea0b6c14

Analysis

max time kernel
75s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:29

Target

d6dad370e0a428908bddd9ff5cbd6f6895410d3083f1a005a9ee813dea0b6c14.dll
Size

6KB
MD5

95aa4d077f1afaa71c9afd22885cded0
SHA1

4c318ac7cf9fe541f782be6deb113bb310020d62
SHA256

d6dad370e0a428908bddd9ff5cbd6f6895410d3083f1a005a9ee813dea0b6c14
SHA512

305635c6969f32f9cc5b0fdc10ba2abdd34e02dade568b9b2d60be3133bd80ba92059f415d1c4a8fc73ad91e28f65a0833993ea7787f1e088eabed384e2942a5
SSDEEP

192:EHRh1eppgt5igptczKuYXZJGrX9zuqd2orLzjj3gpbn3J9wpVStXXU:EHROi5igpizKuYXarX9zuqd2aLzjjwpw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 1656	3496	rundll32.exe	81
PID 3496 wrote to memory of 1656	3496	rundll32.exe	81
PID 3496 wrote to memory of 1656	3496	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6dad370e0a428908bddd9ff5cbd6f6895410d3083f1a005a9ee813dea0b6c14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6dad370e0a428908bddd9ff5cbd6f6895410d3083f1a005a9ee813dea0b6c14.dll,#1
  2⤵
  PID:1656