6ad0c2bd7c098877121fa51946ad1105c6bbcde55f968ee5ec7f1d3cc7885a32

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:41

Target

6ad0c2bd7c098877121fa51946ad1105c6bbcde55f968ee5ec7f1d3cc7885a32.dll
Size

52KB
MD5

927b33d8d457dcfc83ea3631085ad573
SHA1

6f34c6d0f1d5531abc2be37dd9cc3b690525dad3
SHA256

6ad0c2bd7c098877121fa51946ad1105c6bbcde55f968ee5ec7f1d3cc7885a32
SHA512

a1444e62bca2cce86349ce07396431e52e2694090c5a9f0ca09657c1518941c9f69c63bc77d62c19b4273e6b401b100d67cde2bf3b0dada7dab4c2d66c487db3
SSDEEP

768:yuUr3ip/IHI7NQTvfXbkVF6tRVs/LPNEK9Xtwb1qeTxO92gWgwxlVoex:yl3E0TnrDoLNEKhts1qmO92gWfDTx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 4084	2140	rundll32.exe	79
PID 2140 wrote to memory of 4084	2140	rundll32.exe	79
PID 2140 wrote to memory of 4084	2140	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ad0c2bd7c098877121fa51946ad1105c6bbcde55f968ee5ec7f1d3cc7885a32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ad0c2bd7c098877121fa51946ad1105c6bbcde55f968ee5ec7f1d3cc7885a32.dll,#1
  2⤵
  PID:4084