64c1b0b2050a8dd232345cdd19a1f4626278556bc646c2e214a33a3739fd248f

Analysis

max time kernel
186s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:56

Target

64c1b0b2050a8dd232345cdd19a1f4626278556bc646c2e214a33a3739fd248f.dll
Size

6KB
MD5

151b456f483f4fc8ea8c8e47e9542250
SHA1

29f13053967029f055ee37875887cb1264dd598c
SHA256

64c1b0b2050a8dd232345cdd19a1f4626278556bc646c2e214a33a3739fd248f
SHA512

e6bd858d0bc5aa53f9b6879bf6400abf2571136d2e879121d4980070787218e7ee0f33ba2eff0f8b1047833e8a11d184ebda5062bf0de4db4ac13533a3a531d9
SSDEEP

96:nEY2RrF1eqwi42ICeSkPHDIpzqR5fO/rZYkHBC1RrfenSu8HO:EHRh1epp2wS4H8uR1oy0ySnSu8HO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 1816	3180	rundll32.exe	83
PID 3180 wrote to memory of 1816	3180	rundll32.exe	83
PID 3180 wrote to memory of 1816	3180	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c1b0b2050a8dd232345cdd19a1f4626278556bc646c2e214a33a3739fd248f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64c1b0b2050a8dd232345cdd19a1f4626278556bc646c2e214a33a3739fd248f.dll,#1
  2⤵
  PID:1816