6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:57

Target

6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd.dll
Size

32KB
MD5

5f6f1b3ad9c5c2d87ec153aa8d911ce0
SHA1

8fd4e27402204e10cdb2882dbb370719e796255d
SHA256

6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd
SHA512

76321de117e60e657540844a797472ac8491671e145726378cb3284f165cb61385b3bcc467b9f1f15829735c58630f2ed75fd4ba45f1f1b67cce62ada30969ec
SSDEEP

384:xUIsK3EA9NMG5YBPUi9MY9zoDpb77+/VZSXGQG9aFJFrWCRIFCc3:xsKUTeos4MY9zqb7QZkGZ96BTRIQc3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2180	4076	rundll32.exe	81
PID 4076 wrote to memory of 2180	4076	rundll32.exe	81
PID 4076 wrote to memory of 2180	4076	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6621d5f9e608ace8fd8c1fb4359e38b6a3aded2658c7afce5e9c1da030d5ecfd.dll,#1
  2⤵
  PID:2180