1c2de317efef672a4a57ad1d54d22780c092046514c12755668fca001c1e60c4

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 09:22

Target

1c2de317efef672a4a57ad1d54d22780c092046514c12755668fca001c1e60c4.dll
Size

48KB
MD5

71d8b12e831bdb23d7d555888cf39cbb
SHA1

17b8a08cec4064085f9158e8878a97f928a72d0c
SHA256

1c2de317efef672a4a57ad1d54d22780c092046514c12755668fca001c1e60c4
SHA512

6840a4fe90205ce4fe49917c9ae70bf49921d9390fa8bbdcb58a41b503862b82e1401d5385d68e38fa35293593d904ed0117509d0e165e8f168c031cf19ddb34
SSDEEP

768:E5WxRB/JXXBXwTc63PLRTyu0jbAmsTDYyKxhYXo9C:E5WxRBhXXBXw1zRTQj+TLKbAo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 1336	708	rundll32.exe	82
PID 708 wrote to memory of 1336	708	rundll32.exe	82
PID 708 wrote to memory of 1336	708	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c2de317efef672a4a57ad1d54d22780c092046514c12755668fca001c1e60c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c2de317efef672a4a57ad1d54d22780c092046514c12755668fca001c1e60c4.dll,#1
  2⤵
  PID:1336

memory/1336-133-0x0000000002BD0000-0x0000000002CA6000-memory.dmp

Filesize
856KB

Download