cc1e429ff8b8fa20bb4a8507cfa24c0ae4e21a17a6a5c41f566fbf367e207010

Analysis

max time kernel
154s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:48

Target

cc1e429ff8b8fa20bb4a8507cfa24c0ae4e21a17a6a5c41f566fbf367e207010.dll
Size

43KB
MD5

d2eaa1c9c272eebbd18e979b3edb51fd
SHA1

b5a9a0bc56c9949ecb43da34e05f230d628ed2d0
SHA256

cc1e429ff8b8fa20bb4a8507cfa24c0ae4e21a17a6a5c41f566fbf367e207010
SHA512

d55f8101c9d271dd0e597a808b9188b58e9bae49a85cf8c69609be641886b1c4ff894a4f9f37490d25f0169424ca0338a86342f4ac2f60ebd4b7a4b427d2778b
SSDEEP

768:IOneTa0bT/msPZA0lE7ZHFg63i54uSt0X:IOem0vmM6Pg64X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4144	4404	rundll32.exe	80
PID 4404 wrote to memory of 4144	4404	rundll32.exe	80
PID 4404 wrote to memory of 4144	4404	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc1e429ff8b8fa20bb4a8507cfa24c0ae4e21a17a6a5c41f566fbf367e207010.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc1e429ff8b8fa20bb4a8507cfa24c0ae4e21a17a6a5c41f566fbf367e207010.dll,#1
  2⤵
  PID:4144