f6997008f2dc52038e7a1527fdedb5089f63c7ec42c8c87584785b4a884e538c

Analysis

max time kernel
154s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:47

Target

f6997008f2dc52038e7a1527fdedb5089f63c7ec42c8c87584785b4a884e538c.dll
Size

57KB
MD5

ef6826ce462a584cfd476e88abef09d0
SHA1

b524a9294d76ce8e12016a3b4662bcd2dad86cc3
SHA256

f6997008f2dc52038e7a1527fdedb5089f63c7ec42c8c87584785b4a884e538c
SHA512

745caef6b85754ed5a9ffa44370ca5fd2d33a036f3e78e87f559b5e59d32ed704a5adcab08df3a50eea713096af162453a8fb319c63a3c9229906404e20e7332
SSDEEP

1536:qmmMB9R6RTXYOar7n4rwx/3m7XMZDP65+:QMB9R6hYnr74kEXMZDP6c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4848	4960	rundll32.exe	80
PID 4960 wrote to memory of 4848	4960	rundll32.exe	80
PID 4960 wrote to memory of 4848	4960	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6997008f2dc52038e7a1527fdedb5089f63c7ec42c8c87584785b4a884e538c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f6997008f2dc52038e7a1527fdedb5089f63c7ec42c8c87584785b4a884e538c.dll,#1
  2⤵
  PID:4848