ccc24276720cc3cf064bf81b61f144ee1c1277adac38083c88dab26d2195491d

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 04:51

Target

ccc24276720cc3cf064bf81b61f144ee1c1277adac38083c88dab26d2195491d.dll
Size

76KB
MD5

1600fa80ab5038d32e4141589b2f4840
SHA1

2160982448a1c52b8726e81073a0895e91900613
SHA256

ccc24276720cc3cf064bf81b61f144ee1c1277adac38083c88dab26d2195491d
SHA512

9de4c0a57d8420505b94f1f420dff2cbc66284e5df6aff4e8817fc2040e36c59222448d534a0f5baffed4cf39999601ec87059253060554a46721fe799248609
SSDEEP

1536:9DWFwc8+TpKSKiuowMAYGpAYJnodSIINxHvTrUKOXh4a:9Dowc8FiuCAYGpAYJnodQvE4a

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2120	1056	rundll32.exe	81
PID 1056 wrote to memory of 2120	1056	rundll32.exe	81
PID 1056 wrote to memory of 2120	1056	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccc24276720cc3cf064bf81b61f144ee1c1277adac38083c88dab26d2195491d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccc24276720cc3cf064bf81b61f144ee1c1277adac38083c88dab26d2195491d.dll,#1
  2⤵
  PID:2120