206c03dd2d765d9c870f1607e2ab04ebd8d129d7ac6e7fce362ccf58b77ad300

Analysis

max time kernel
188s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 02:05

Target

206c03dd2d765d9c870f1607e2ab04ebd8d129d7ac6e7fce362ccf58b77ad300.dll
Size

24KB
MD5

cfe330145aff344d95383aa5907608e0
SHA1

46d96e2321eb675da357ef4725bd807d71965744
SHA256

206c03dd2d765d9c870f1607e2ab04ebd8d129d7ac6e7fce362ccf58b77ad300
SHA512

b6d4fcae0fe904865445d1f7e6977bafe2e5cfd26fa770d5077ef2bddc04ea64f0740f53ce9a5f15d1281eec29f96e190a1dcc47fb697a109e93476ed61e6838
SSDEEP

384:p5//hyXNdtyXNdjByCvbxZENkqR928QBNwMjudzuF9yBeD/l7LPfS0:p5hctcjsCvbx2928QBO309QerRLS0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 3876	4020	rundll32.exe	81
PID 4020 wrote to memory of 3876	4020	rundll32.exe	81
PID 4020 wrote to memory of 3876	4020	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\206c03dd2d765d9c870f1607e2ab04ebd8d129d7ac6e7fce362ccf58b77ad300.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\206c03dd2d765d9c870f1607e2ab04ebd8d129d7ac6e7fce362ccf58b77ad300.dll,#1
  2⤵
  PID:3876