6a6364f33c6dfdaaca78f775540ab77bfd39137bc3283fd20485db7777108ac3

Analysis

max time kernel
171s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 00:49

Target

6a6364f33c6dfdaaca78f775540ab77bfd39137bc3283fd20485db7777108ac3.dll
Size

6KB
MD5

25645a348529b5acec26378594a3d350
SHA1

d82ebecb27b9e08a5f945b5cedea46874d8efbd7
SHA256

6a6364f33c6dfdaaca78f775540ab77bfd39137bc3283fd20485db7777108ac3
SHA512

f96ec70edd7bc62026ada59f5e0d04c2fb98d30b3fe6e7d074556cf37c1456a6c4cdc92670dd673746ec903906d185fdb07776685294094a45b6ae9e9abc16d8
SSDEEP

192:EHRh1epp/HHogAHtwZ44BHO/HhCxvttZ3:EHROZnogmtwZ44ZAhUvZ3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 5088	2432	rundll32.exe	79
PID 2432 wrote to memory of 5088	2432	rundll32.exe	79
PID 2432 wrote to memory of 5088	2432	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6364f33c6dfdaaca78f775540ab77bfd39137bc3283fd20485db7777108ac3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a6364f33c6dfdaaca78f775540ab77bfd39137bc3283fd20485db7777108ac3.dll,#1
  2⤵
  PID:5088