d6c208ab9c17cc4a6cc4e52880819de4b6aeb15d0566998061d722ba4aa0a631

Analysis

max time kernel
151s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:16

Target

d6c208ab9c17cc4a6cc4e52880819de4b6aeb15d0566998061d722ba4aa0a631.dll
Size

42KB
MD5

46968d50cbff390d3b9153398dbd980b
SHA1

8b71177dcc03eeb74127dfb0c712d7aec9fce8c1
SHA256

d6c208ab9c17cc4a6cc4e52880819de4b6aeb15d0566998061d722ba4aa0a631
SHA512

ddd8d0359173a8f8596da3757d217c2201bb4cb4c42db5b3bcb5f098cbb72ec06b19da43b32992d13ef71793cd90b54ee6144be712f7e4b38a0088869c59187d
SSDEEP

768:xS9kCecstltvp4mHMXI5qcP41CI8bi4LKDgg/pDDluXCtvUwT:xkkCewvo7PcCIfJDggBXIIcwT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1672	3836	rundll32.exe	80
PID 3836 wrote to memory of 1672	3836	rundll32.exe	80
PID 3836 wrote to memory of 1672	3836	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6c208ab9c17cc4a6cc4e52880819de4b6aeb15d0566998061d722ba4aa0a631.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6c208ab9c17cc4a6cc4e52880819de4b6aeb15d0566998061d722ba4aa0a631.dll,#1
  2⤵
  PID:1672

memory/1672-133-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download