ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25

Analysis

max time kernel
105s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 16:47

Target

ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25.dll
Size

4KB
MD5

3aee63902559602a170d1056dc7b1386
SHA1

61d18bbbc51ca97c1a4091d40245872a99d2fbee
SHA256

ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25
SHA512

2f22cb805566dc28f57f512c23af6f55db61f1478c87022a73a3414d83d148c2ce0e7044bea1e0dfe55c635206923270e3fe0a68f3db4f689a3ab8dc46cf1a0f
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKCg8iXgSvlmkpcv7hXoMlBo1pzuFKu2Af:PT3r2vu9G8mdhczZ/sxe5df

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4788	4892	rundll32.exe	81
PID 4892 wrote to memory of 4788	4892	rundll32.exe	81
PID 4892 wrote to memory of 4788	4892	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf9d7722489158be38e7836f7c043688d90c6908d8f2b57e45afc716c7e4a25.dll,#1
  2⤵
  PID:4788