6813bc2cc8eb3232a90cc584b518e59bb3d5944198c5cc90e287b8b3af42ead8

Analysis

max time kernel
159s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:00

Target

6813bc2cc8eb3232a90cc584b518e59bb3d5944198c5cc90e287b8b3af42ead8.dll
Size

4KB
MD5

dec63c45bf1701deb4d449b971cdc8f0
SHA1

830c41f429e9a7ba5d60e12ed792fa18b8d97a5c
SHA256

6813bc2cc8eb3232a90cc584b518e59bb3d5944198c5cc90e287b8b3af42ead8
SHA512

20d2380079d3bdf77fb08d7262ea22aea3268bc21cb126b92d0319d8ee05bd2bcf49016b2bb09fe1bb463ab53626f10556d122e510ec95cc9c58bcdfb4fd21d6
SSDEEP

24:eNGS7EiUT73Ce2v/kPVCRVtc44MxFOKMtc8v874IVHLejjVkEfwP8en3r2WwwiR+:a7Q2voyT+Bt5a9gRoZ3ruRbX5dcJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1940	5084	rundll32.exe	80
PID 5084 wrote to memory of 1940	5084	rundll32.exe	80
PID 5084 wrote to memory of 1940	5084	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6813bc2cc8eb3232a90cc584b518e59bb3d5944198c5cc90e287b8b3af42ead8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6813bc2cc8eb3232a90cc584b518e59bb3d5944198c5cc90e287b8b3af42ead8.dll,#1
  2⤵
  PID:1940