cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb

Analysis

max time kernel
117s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:40

Target

cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb.dll
Size

30KB
MD5

6d532e38dc5f6a9dc2c74aade1aa111b
SHA1

84a38f20c26890d3848dac86fe83592289ac1799
SHA256

cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb
SHA512

e25458507f49e87af70aa674c73b50d170da0b24f47bf463127cd8505ba409c913750a6ffb6dbfeeb320d72dba900ecef8822dcaace8f3402c11fcc0bf4124b6
SSDEEP

384:Lm5S1+/I4gZOJAzA4yxRJ5by77AzOgGtepeopxUawPJFJUFfSqEyVIDv:ig1+w4HJOqxRjy7QOPtDWUhhDomDv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1080	1556	rundll32.exe	79
PID 1556 wrote to memory of 1080	1556	rundll32.exe	79
PID 1556 wrote to memory of 1080	1556	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5e572ef1a22ec1a1a4dd1076be90f96ef8283ff0724993d2397180e70e7eeb.dll,#1
  2⤵
  PID:1080