bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6

Analysis

max time kernel
91s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:49

Target

bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6.dll
Size

5KB
MD5

5476f11b7b267b2912f7381e2c5f0600
SHA1

3d7c6c80541d548feab9c5ccdd043e1d7e209642
SHA256

bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6
SHA512

5512ac68175bfb6e02a387026400e8f223e3ffb5a78f390f649445867674966d975bb8bdce9eb93fe826145be66f113751d4d52042d615207d9db6a3beca8fa2
SSDEEP

96:nEY2RrF1eqwi4ZVLB4byU0aahII5yWZu7dbWz4:EHRh1eppjBoEII5yUAH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4384	4996	rundll32.exe	82
PID 4996 wrote to memory of 4384	4996	rundll32.exe	82
PID 4996 wrote to memory of 4384	4996	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb6ed1d9394be9f1c62833e28b6f58b270be6789aab4d38fba34dfea6f9609a6.dll,#1
  2⤵
  PID:4384