c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63

Analysis

max time kernel
193s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 13:25

Target

c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63.dll
Size

110KB
MD5

c6a4ba42bdda16117ea1098e01c5147b
SHA1

7d122562bfe6c4656d124f681a0d50d100f5404d
SHA256

c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63
SHA512

1ea982859bf63702c7db0c17cfa787d74bcd7041eb2855e237f1116e72011f809695334c99aa7fbcad9acf2f9de9d8ba53213528abd83bb369fe14efc7cb1ccb
SSDEEP

1536:XIXbIMIqkuvfZ/AuwTVxsKDjirfmWHfqeyqkaUiqvic8fO89:X0fxxvfGTVaCkiqRue

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 208	2932	rundll32.exe	81
PID 2932 wrote to memory of 208	2932	rundll32.exe	81
PID 2932 wrote to memory of 208	2932	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6fd0e90f3c8b803a329170c21a26afa88464df142cbdc9262037c8396365e63.dll,#1
  2⤵
  PID:208

memory/208-133-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download