2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 19:53

Target

2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd.dll
Size

59KB
MD5

0f5583d8d8bfc6d17b404c414349f48b
SHA1

0a78d53939a0a55b226f708fb871e9af1684e73b
SHA256

2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd
SHA512

e1d1738cca63844ddb94b8614bfdc98435c8da9c088265f79d387db1bd936f92d83f66397dff77b81e2346bdcfe675da2fc5db973cc857ffae117abf1b0a4626
SSDEEP

1536:Cgm4z/jyqizD1lMmB6V59GhFAMmEobxVn:C7ueq8N64Yoobx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2128	4836	rundll32.exe	82
PID 4836 wrote to memory of 2128	4836	rundll32.exe	82
PID 4836 wrote to memory of 2128	4836	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd.dll,#1
  2⤵
  PID:2128

memory/2128-136-0x0000000000A40000-0x0000000000A4A000-memory.dmp

Filesize
40KB

Download
memory/2128-140-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download