2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7

Analysis

max time kernel
186s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:33

Target

2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7.dll
Size

57KB
MD5

d2855946048267836ee162a97db49e60
SHA1

cb31ebdc76f9ed0924149f74a27187ede1928e6c
SHA256

2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7
SHA512

2d5bc9136bdf66fca95649d5b6c6238c636a51a00a92492bb2f98916600b778cedefae4baa84dcd9b60fa329c43867d447fd5326287d44c9a120b70f8618e4e9
SSDEEP

1536:e6PViKuLJqOf7WxUDF9OciPINW2inKzsBj:RViKuMOftZ95iQNWZsU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3332	1312	rundll32.exe	83
PID 1312 wrote to memory of 3332	1312	rundll32.exe	83
PID 1312 wrote to memory of 3332	1312	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf1668ffd59cbc555ced7e64604e3b899997030208b6d22ee800b01f3976ac7.dll,#1
  2⤵
  PID:3332