6baa0a59a0dfd4ace124b8f8fe42e42f19080dc0e6930e72a620ec7b8d570d31

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2023 08:11

Target

6baa0a59a0dfd4ace124b8f8fe42e42f19080dc0e6930e72a620ec7b8d570d31.dll
Size

1.9MB
MD5

a98966284ea6f3b9e1f1b0c511841b8f
SHA1

2befd0aaf45bd960daec40697dd558e02a5b4d1c
SHA256

6baa0a59a0dfd4ace124b8f8fe42e42f19080dc0e6930e72a620ec7b8d570d31
SHA512

b1efaea625e147e384b4e3fa2a18cccf019638e2bab2ae5f49ee939ae22a2be7fabf1d14f11909f3df1cf43af181313f3055f78a7bfb15003a2c78c1e6ff5f67
SSDEEP

49152:sDQyutdyw3ONkSqh7mdsI3ozug+ZDPnO:s1utdywIDqasI3o0DP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 1240	408	rundll32.exe	85
PID 408 wrote to memory of 1240	408	rundll32.exe	85
PID 408 wrote to memory of 1240	408	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6baa0a59a0dfd4ace124b8f8fe42e42f19080dc0e6930e72a620ec7b8d570d31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6baa0a59a0dfd4ace124b8f8fe42e42f19080dc0e6930e72a620ec7b8d570d31.dll,#1
  2⤵
  PID:1240