608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330

Analysis

max time kernel
131s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 20:40

Target

608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330.dll
Size

64KB
MD5

60d79fa0aa3567699ced81d8dd07b060
SHA1

14cdbbf93409c757f0827bb476fd1ad3d6da1015
SHA256

608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330
SHA512

6f127eaa1563cd474b176c46af16bb5e43dec92fc49261caa68e924279984c87d5a169cc0d2f9d7f868e6f839189f14808ee3926bf3d8590903311de0178e3d3
SSDEEP

1536:ob8Vwn/JzagaQDqKQs4DcVWPBPjrB3kF+Wqvf:oz/JfmsocVW5PBkFPqH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5048	4920	rundll32.exe	82
PID 4920 wrote to memory of 5048	4920	rundll32.exe	82
PID 4920 wrote to memory of 5048	4920	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\608c15cc383fbcbe4a099d24a08fd0be8001008230dc2102e63abe6bda328330.dll,#1
  2⤵
  PID:5048