cd35db81e115abd38db0aa07a8440a47f79821bf410cc66b39ed2f93b7589ca4

Analysis

max time kernel
133s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 04:50

Target

cd35db81e115abd38db0aa07a8440a47f79821bf410cc66b39ed2f93b7589ca4.dll
Size

484KB
MD5

688e6a1b96864193ff48f01e5238ebaf
SHA1

722efcccfa9927e1cb7499268597e0ea609d4217
SHA256

cd35db81e115abd38db0aa07a8440a47f79821bf410cc66b39ed2f93b7589ca4
SHA512

98f9a589381c267d3c8d5b44d3c53fbb64e3af0d787e4968a960d74f83e02e10c76d98979130202f2cd03b6d23a7aa057bab2dfcbb070b1a9358ea2af7e58c56
SSDEEP

12288:+wnCFKENlcW7MC227bA95U1Im3pHQCaOOfD:CNlJMC22XA9k9IhD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 2496	4360	rundll32.exe	78
PID 4360 wrote to memory of 2496	4360	rundll32.exe	78
PID 4360 wrote to memory of 2496	4360	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd35db81e115abd38db0aa07a8440a47f79821bf410cc66b39ed2f93b7589ca4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd35db81e115abd38db0aa07a8440a47f79821bf410cc66b39ed2f93b7589ca4.dll,#1
  2⤵
  PID:2496

memory/2496-133-0x0000000010000000-0x0000000010083000-memory.dmp

Filesize
524KB

Download