60a36b46483467737c6003f051340556587687557648e394ce6e78729c5b6af9

Analysis

max time kernel
151s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 16:06

Target

60a36b46483467737c6003f051340556587687557648e394ce6e78729c5b6af9.dll
Size

190KB
MD5

5859aee8839209f65d1d63fb7812c834
SHA1

ceee82a7ffa20e7e338e051307beb89b7ec16581
SHA256

60a36b46483467737c6003f051340556587687557648e394ce6e78729c5b6af9
SHA512

49c279afc56f5ad1e29c5ce307ff13b25426cb8f20d547bae6909ff34fe2b1abc85bce6b789e3b7d399b3a84ec0c908219db2073c18c03e2d2ddefa538429a85
SSDEEP

3072:MzQ/QnBMpwnZfyz85/XHshrOKLJdhZQWxD4oFeN/mr+sSGQAVi:4Q/Qnap8y+MhrOQjtDxeN/4+sGAVi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4256	5008	rundll32.exe	82
PID 5008 wrote to memory of 4256	5008	rundll32.exe	82
PID 5008 wrote to memory of 4256	5008	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60a36b46483467737c6003f051340556587687557648e394ce6e78729c5b6af9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60a36b46483467737c6003f051340556587687557648e394ce6e78729c5b6af9.dll,#1
  2⤵
  PID:4256