cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769

Analysis

max time kernel
111s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:58

Target

cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769.dll
Size

57KB
MD5

b309532c5f731007fbb19dcce80d0512
SHA1

8d8d2f7636422a0e5f3d28a397b3981cb7a04088
SHA256

cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769
SHA512

e4aa43b3f9467d9e1f48690d09deb54676c5183ebe8deffa467f08a0056349b3d7857e2d6a9e1706274f955d7f6cce2eff34232864ab4e8faa118cafadb02561
SSDEEP

1536:lNIKDP4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:QqP4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2268	1812	rundll32.exe	80
PID 1812 wrote to memory of 2268	1812	rundll32.exe	80
PID 1812 wrote to memory of 2268	1812	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769.dll,#1
  2⤵
  PID:2268