60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8

Analysis

max time kernel
135s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:35

Target

60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8.dll
Size

6KB
MD5

a97177fee1251187a5ea5c4bb6d2e120
SHA1

0e7edb916a531bd25209074fbbadafc90f8c94c0
SHA256

60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8
SHA512

2df73d082b9b7c4a998e67dee42bfbc4d494b8bde613033a823c742d4e8a3e1c0bc1f2778ac10ddbd218eaeb4aeec29bdec6dbfeed3f09dcdabe190bcb11a6a8
SSDEEP

96:nEY2RrF1eqwi4yJ5OuuYEFIp1pTxZs8hISXl33eamWH:EHRh1eppyJ5P1M8hISXl3OWH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1352	1176	rundll32.exe	80
PID 1176 wrote to memory of 1352	1176	rundll32.exe	80
PID 1176 wrote to memory of 1352	1176	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60f4a6b530184719813fcfe5dee7aadf6dd93ff886e70004b0b86f4f5294d9a8.dll,#1
  2⤵
  PID:1352