cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 01:10

Target

cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109.dll
Size

206KB
MD5

a3a7f9f4bdfc99e5c231d8176f4605c5
SHA1

a798c566581aaad8b9ffca4a9c08ae0b51510217
SHA256

cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109
SHA512

8b7b22003752aeb4d37f2473614558c12ef1f9b93307188d997474342b83defa01a47115f425550d3d38f9af1d1a46c9d332e8aeabeb1fb8ac00561ce652d0a9
SSDEEP

6144:l1DGl8VKOe250FO3pPdjJIy3irACfjpkt:lxGaUOe25aavjJIMAfjpk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 4196	2536	rundll32.exe	81
PID 2536 wrote to memory of 4196	2536	rundll32.exe	81
PID 2536 wrote to memory of 4196	2536	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdaac6fdc3bc43ee04f570e7d2865d56c1a873c061335f0385adb0ffdfb5d109.dll,#1
  2⤵
  PID:4196