cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0

Analysis

max time kernel
188s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 17:29

Target

cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0.dll
Size

57KB
MD5

aa4e707a1795b45140f18d8c982401d8
SHA1

658d4b81f560769779744bfdef036cb355093b27
SHA256

cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0
SHA512

16593e11490693bfb62020052ebe1bc91fe224f45efb67d5fc146abaf048bc13cae828e16730fe3201ee37fa467f187f035315e4b769a6940dfb2f4428c59f4a
SSDEEP

1536:RNIKDP4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:cqP4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4480	4956	rundll32.exe	82
PID 4956 wrote to memory of 4480	4956	rundll32.exe	82
PID 4956 wrote to memory of 4480	4956	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd82056c33d65d2fc96ac04b61f092418b620f081ac1b33ae9a5589f3d42a8a0.dll,#1
  2⤵
  PID:4480