6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23

Analysis

max time kernel
82s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 02:20

Target

6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23.dll
Size

7KB
MD5

30b5967e20427091392c2b3ba32c17c0
SHA1

a9b3abade24e4bcd3d8684a61a7a39f6ec80488f
SHA256

6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23
SHA512

1fd6680d73f51a9f50882665474211854b4ed1489e2370bfdfa8c9e157b6036f847249625df949782a8789dd46bd5c3e81b88117aebb3b496ef9f0518027c219
SSDEEP

96:hyZxm/jmjhjvj3jcZGV4sr+x4cEhvyyFUitDVJU0A1yjM0n9F:2M/SdjbgYj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3012	3736	rundll32.exe	53
PID 3736 wrote to memory of 3012	3736	rundll32.exe	53
PID 3736 wrote to memory of 3012	3736	rundll32.exe	53

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6aa31dd83f935408dcd7e1de6131c89bf24f5eedee2c4f4e0deeaf118e5d6e23.dll,#1
  2⤵
  PID:3012