6fb0ad3f756b5d1f871cf34c3e4ea47cb34643cd17709a09c25076c400313adf

Analysis

max time kernel
90s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2023, 19:27

Target

3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8.dll
Size

1.4MB
MD5

3e1b04282d2d7d5b48a6de81c34a564f
SHA1

3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8
SHA256

6fb0ad3f756b5d1f871cf34c3e4ea47cb34643cd17709a09c25076c400313adf
SHA512

a098efa2533cab955377480aedb81937fc5cb8caa84260528d309cd13ddfa7b1a28155d36355cb38f369d30e20125df50a6523884c152359c6b53655cf1a39d0
SSDEEP

24576:gsZLRYbIQfH9mE91jsNQtQ5dIiu0WdzVt8UoBWpCN2CmazALe7WzpmV:g8LRYb3HzePlu0wgKetqKWVm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4908	4800	rundll32.exe	82
PID 4800 wrote to memory of 4908	4800	rundll32.exe	82
PID 4800 wrote to memory of 4908	4800	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8.dll,#1
  2⤵
  PID:4908

memory/4908-133-0x0000000074C70000-0x0000000074DE5000-memory.dmp

Filesize
1.5MB

Download
memory/4908-134-0x0000000001EF0000-0x000000000200D000-memory.dmp

Filesize
1.1MB

Download
memory/4908-135-0x0000000074C70000-0x0000000074DE5000-memory.dmp

Filesize
1.5MB

Download
memory/4908-136-0x0000000001EF0000-0x0000000001FB0000-memory.dmp

Filesize
768KB

Download
memory/4908-137-0x0000000001FB0000-0x000000000205A000-memory.dmp

Filesize
680KB

Download
memory/4908-140-0x0000000074C70000-0x0000000074D76000-memory.dmp

Filesize
1.0MB

Download
memory/4908-141-0x0000000001EF0000-0x000000000200D000-memory.dmp

Filesize
1.1MB

Download