2cc92af4c031de9348ebbaf8bf53ca99ca94caad750b47a87412075ab9694fdd

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:06

Target

2cc92af4c031de9348ebbaf8bf53ca99ca94caad750b47a87412075ab9694fdd.dll
Size

204KB
MD5

6302aa8fd824e1dfc62dd1fca42cefa0
SHA1

db6d4139f5f8224c33ea098f4f9d5ce27f5f0d73
SHA256

2cc92af4c031de9348ebbaf8bf53ca99ca94caad750b47a87412075ab9694fdd
SHA512

cc6228822361bab42934afe9984d9572c29168535a2c92096aae8916348663d80eb857f16807f328fb80e22f55f6def88fc14f04e23880ff5f1a9d5bb1491f44
SSDEEP

3072:mMkZXb9Bj7OWLYNdyDIGjv8T68JuEb2753qTGP1Ssc7RoPmH0qHpcO5VSzjMvMsF:86Mu6uk3EhEsZ5AA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc92af4c031de9348ebbaf8bf53ca99ca94caad750b47a87412075ab9694fdd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc92af4c031de9348ebbaf8bf53ca99ca94caad750b47a87412075ab9694fdd.dll,#1
  2⤵
  PID:1832

memory/1832-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download