6a657ff1abe5c03b22292efcd33863e90dbcf41fb5513cf9c3e4c1d6947f280f

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:10

Target

6a657ff1abe5c03b22292efcd33863e90dbcf41fb5513cf9c3e4c1d6947f280f.dll
Size

52KB
MD5

9347cb04516d2b4dde84fe1d0798aa06
SHA1

bb4d8c672acdd091098f9fd0825a94f2edfe51f9
SHA256

6a657ff1abe5c03b22292efcd33863e90dbcf41fb5513cf9c3e4c1d6947f280f
SHA512

83dfa06cf8811e9be42c05c6f5eed9956f4802fedafcf886bc9184b689828b7d42ec104f27208abec4d34c4038db2fa488f4ad2301d8b2bbd2677f75d5627ed7
SSDEEP

1536:5jRmOqiWPpTUEWCjpKzgqGamTO7oK1DjV69:xfqdhU2jOgqGamTahjV69

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 2408	788	rundll32.exe	80
PID 788 wrote to memory of 2408	788	rundll32.exe	80
PID 788 wrote to memory of 2408	788	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a657ff1abe5c03b22292efcd33863e90dbcf41fb5513cf9c3e4c1d6947f280f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a657ff1abe5c03b22292efcd33863e90dbcf41fb5513cf9c3e4c1d6947f280f.dll,#1
  2⤵
  PID:2408

memory/2408-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download