cbd0e699698ad0b2ded33d5b10e1b747598d734995fe569d00d0cd1835060462

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 18:40

Target

cbd0e699698ad0b2ded33d5b10e1b747598d734995fe569d00d0cd1835060462.dll
Size

15KB
MD5

0b62daa977e67cb3cf4c717426be358c
SHA1

23297061fa901d720877baf12af2ad80a0f6a4f6
SHA256

cbd0e699698ad0b2ded33d5b10e1b747598d734995fe569d00d0cd1835060462
SHA512

38119e7b56dd10b2735aa724a4650e8e042bce409f3a295935c07cb856df85a4c92956daa9d2ef5b219e7b33c1753e4430bc3a610cfd6ce579291fe03d0c4ec7
SSDEEP

192:SC0itFaWlB2SYxmJzTQsoHImVigU6d984blsckwLsBb/d6T+z9SCqGfFMK8:SCb662ZWzh3ws1Jb/KU9SCq8FMK8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2608	4988	rundll32.exe	82
PID 4988 wrote to memory of 2608	4988	rundll32.exe	82
PID 4988 wrote to memory of 2608	4988	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbd0e699698ad0b2ded33d5b10e1b747598d734995fe569d00d0cd1835060462.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbd0e699698ad0b2ded33d5b10e1b747598d734995fe569d00d0cd1835060462.dll,#1
  2⤵
  PID:2608