6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a

Analysis

max time kernel
106s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:26

Target

6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a.dll
Size

6KB
MD5

56d4e1c3ac239ab4f14ef226bd2e2700
SHA1

dbda6e756242709880b2029b2b55cb1227bd7a8c
SHA256

6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a
SHA512

e610b4267cdcb15108ed83b52079cab579668fb0b346432c69d5e9f33d8923405a04b454f21089f82108ad62981216fbde1253822829cb3bfb84bf49b35a8ccb
SSDEEP

192:Ft11+PANORH+kXbVJN2WqewcH2njc9FCTpHIJFAlLbR:Fb04NORH+kXbVJN2WqewcH2jc9FCTpH3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 3444	2328	rundll32.exe	79
PID 2328 wrote to memory of 3444	2328	rundll32.exe	79
PID 2328 wrote to memory of 3444	2328	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ecab2936317cb76fa2f909ec75b89786b6999f03bfab712a9a882658d47933a.dll,#1
  2⤵
  PID:3444