6d7ff1bac4f7ae94e0ed2d4ef92bb5a0aa50f125102d619dd8da1f6fee386953

Analysis

max time kernel
148s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:25

Target

6d7ff1bac4f7ae94e0ed2d4ef92bb5a0aa50f125102d619dd8da1f6fee386953.dll
Size

7KB
MD5

fb3adefac1a0bdba42c716f50af78ec0
SHA1

670b367351ff3f7cdd45266890852d14a6f9bcc0
SHA256

6d7ff1bac4f7ae94e0ed2d4ef92bb5a0aa50f125102d619dd8da1f6fee386953
SHA512

c40e00e9a35dad052cd292a68c1bd3ce82eaf0ed197becd1057626ab7a1addc0385cffe552f588173666999ba455fe5c94bebb2fe603c5f62b1cee20dad63489
SSDEEP

192:YXzyeXj2NIIKqFzHiugYARTAvtQtXXpOJDpIA6VSkF0U:Yhyl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2760	2140	rundll32.exe	84
PID 2140 wrote to memory of 2760	2140	rundll32.exe	84
PID 2140 wrote to memory of 2760	2140	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d7ff1bac4f7ae94e0ed2d4ef92bb5a0aa50f125102d619dd8da1f6fee386953.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d7ff1bac4f7ae94e0ed2d4ef92bb5a0aa50f125102d619dd8da1f6fee386953.dll,#1
  2⤵
  PID:2760