cc5ebce9e38cc24549a145da59f9c40bb3e799f386b69dd59155f343b0f7602e

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:50

Target

cc5ebce9e38cc24549a145da59f9c40bb3e799f386b69dd59155f343b0f7602e.dll
Size

52KB
MD5

34a9bbf5351fa7ba4075be9a6c6a6e2c
SHA1

e577f73835989691588df8650156a539b35f2c63
SHA256

cc5ebce9e38cc24549a145da59f9c40bb3e799f386b69dd59155f343b0f7602e
SHA512

3f349d4ab3206f220bae1c0593f0aa1d99e052772fabf79217dd32c0f2acfd731e4fc559e08a905d217864490ccfb0a0c2111242423bb39adb38f920bf312105
SSDEEP

768:pEwzsUfKPzc9yzWD5+1lGCH/1aR25Ttos7XXefuHGHbtQafiazj0o:pKUfqzcQu5+LH/1q252meuw0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5ebce9e38cc24549a145da59f9c40bb3e799f386b69dd59155f343b0f7602e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5ebce9e38cc24549a145da59f9c40bb3e799f386b69dd59155f343b0f7602e.dll,#1
  2⤵
  PID:1808

memory/1808-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download