b2c8736c2c58b346975a8cea8bf5433c6a681a6a4cd87d4df7ed19bf3406ac6c

Analysis

max time kernel
76s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 08:09

Target

b2c8736c2c58b346975a8cea8bf5433c6a681a6a4cd87d4df7ed19bf3406ac6c.dll
Size

351KB
MD5

6c9f3acc35eec61ff541efdcaca5e18d
SHA1

c7a5801aad36e4ebcf39ef39e4750687c7b8dc64
SHA256

b2c8736c2c58b346975a8cea8bf5433c6a681a6a4cd87d4df7ed19bf3406ac6c
SHA512

503fe6f571b81377cfa77ddec621e40c2674ccaa0b572a97897881fa8da96cba8f8c2bd362ee3d1041a904f798977a30b29b66e653cfc85f23442a445eff00e3
SSDEEP

6144:e+m+m+m+m+m+m+m+m+m+m+m+m+m+m+m+m+m+m+:effffffffffffffffff

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4304	2760	rundll32.exe	80
PID 2760 wrote to memory of 4304	2760	rundll32.exe	80
PID 2760 wrote to memory of 4304	2760	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2c8736c2c58b346975a8cea8bf5433c6a681a6a4cd87d4df7ed19bf3406ac6c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2c8736c2c58b346975a8cea8bf5433c6a681a6a4cd87d4df7ed19bf3406ac6c.dll,#1
  2⤵
  PID:4304