cc20ad51a6124e182e642d43f116e466d842545a053b61fda030a6bce6fa0a74

Analysis

max time kernel
125s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 18:49

Target

cc20ad51a6124e182e642d43f116e466d842545a053b61fda030a6bce6fa0a74.dll
Size

76KB
MD5

81e13b9ee3e10bf73b728574886da3ca
SHA1

6c5655e2250c961803d878612e98aab2ab5ff3e5
SHA256

cc20ad51a6124e182e642d43f116e466d842545a053b61fda030a6bce6fa0a74
SHA512

073eedf6bc1568a25b4179b80104c2331e1dfd04e81ca82be89591a6e4c63aa43e40517fe7289c9ce00e7ed0a0f2b78477eb345a49bef8105ba802ee2a09c129
SSDEEP

1536:trEzMwFTZ/2AINgeANxRvcpxHhqfFNQbkOEfLDSQ6l7X4p:azPF9//eSx6xHWNqkFLD969Ip

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 536	1084	rundll32.exe	80
PID 1084 wrote to memory of 536	1084	rundll32.exe	80
PID 1084 wrote to memory of 536	1084	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc20ad51a6124e182e642d43f116e466d842545a053b61fda030a6bce6fa0a74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc20ad51a6124e182e642d43f116e466d842545a053b61fda030a6bce6fa0a74.dll,#1
  2⤵
  PID:536