b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb

Analysis

max time kernel
132s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 06:47

Target

b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb.dll
Size

139KB
MD5

e550b7799969c988e1922999f220bc87
SHA1

c04dd205ca554361332d8bcfa221cbd2b247a255
SHA256

b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb
SHA512

f53264c4776438c3b7b82081725cb97c49b71925fa5d399c52fa831c28508e3ba34c9bf6e738ebe3549a981697f86ff253fce61c202053e7691baf9968816927
SSDEEP

3072:1bDv3BhbrRd0jm/iLVO8WplhNn3HxAF74xMll0Dt:1bDJl0jm/inMDXxAZ1EDt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2260	4556	rundll32.exe	83
PID 4556 wrote to memory of 2260	4556	rundll32.exe	83
PID 4556 wrote to memory of 2260	4556	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b68e13b0c5b9ea37f0c12261b856e8d65cdef3b32b03d09cbcb99704729fbb.dll,#1
  2⤵
  PID:2260