0cbd61875e9ac8b639beaecd57ff09ca48740471d2893529681c85dfc54396a5

Analysis

max time kernel
91s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:24

Target

0cbd61875e9ac8b639beaecd57ff09ca48740471d2893529681c85dfc54396a5.dll
Size

6KB
MD5

739afd865e54fb286d199c15500272d0
SHA1

d2ddc9df5d5e5b4d095ba7058a1988eafe08acc2
SHA256

0cbd61875e9ac8b639beaecd57ff09ca48740471d2893529681c85dfc54396a5
SHA512

d2d4fd0ca308c6d6155f2ca4e57f164f21cd237ac5f883aa4a984fdf55f392be3cfdce1138384324e1985c3aad6b46b19978e8a9ba5b42d5efbd8168179302c2
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD76/Lo:nGTWJGp0UZUd6378snt76/U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1312	4252	rundll32.exe	81
PID 4252 wrote to memory of 1312	4252	rundll32.exe	81
PID 4252 wrote to memory of 1312	4252	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cbd61875e9ac8b639beaecd57ff09ca48740471d2893529681c85dfc54396a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cbd61875e9ac8b639beaecd57ff09ca48740471d2893529681c85dfc54396a5.dll,#1
  2⤵
  PID:1312