6a46a7ec80a2e121682f95dbfe7208fd7d37e0e212a3a4c21b5824b6799c8acb

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 23:58

Target

6a46a7ec80a2e121682f95dbfe7208fd7d37e0e212a3a4c21b5824b6799c8acb.dll
Size

6KB
MD5

205901872b4f9c1f3ed5e12c40b86ce0
SHA1

e44305209078d307ede19afd43ab3a2060a239be
SHA256

6a46a7ec80a2e121682f95dbfe7208fd7d37e0e212a3a4c21b5824b6799c8acb
SHA512

5d7dc9ce8e2c5d24857e50d2118f08e2f2437b42351d4cdcb0cb02fe0efcd56bbdaf09923e14b09e3c316aa6108aa3c28a95896e01493c2b440aa515084a04dc
SSDEEP

96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7J1w:juLJ/oAdQPQa2aeng7J1w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2536	4756	rundll32.exe	79
PID 4756 wrote to memory of 2536	4756	rundll32.exe	79
PID 4756 wrote to memory of 2536	4756	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a46a7ec80a2e121682f95dbfe7208fd7d37e0e212a3a4c21b5824b6799c8acb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a46a7ec80a2e121682f95dbfe7208fd7d37e0e212a3a4c21b5824b6799c8acb.dll,#1
  2⤵
  PID:2536