ccbe9c7de910ee51d1c278f566847e6a0ed29a68bd12c9266ba5b01178200ea1

Analysis

max time kernel
155s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 18:14

Target

ccbe9c7de910ee51d1c278f566847e6a0ed29a68bd12c9266ba5b01178200ea1.dll
Size

84KB
MD5

04e31eaeaa2ecf9fc7c93a396476eb8b
SHA1

d7b3de21e428eaca57e512063874717c815569b7
SHA256

ccbe9c7de910ee51d1c278f566847e6a0ed29a68bd12c9266ba5b01178200ea1
SHA512

06b25adc64f28c33f12a5d3ce678993d06f83ff197cbb5351458691bfe93d0f0d709d0492f94970736b438bc046854507d6bba8e9204e12ccce915a111fb6b95
SSDEEP

1536:NYuRlYr2QiDkUVWCcZ0HdItrxX3tBY0qe+MYGZE2yOmOAET:GuRlYKQiDkqyZ0upxHTY0qe9ByOmOz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 5112	4772	rundll32.exe	80
PID 4772 wrote to memory of 5112	4772	rundll32.exe	80
PID 4772 wrote to memory of 5112	4772	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccbe9c7de910ee51d1c278f566847e6a0ed29a68bd12c9266ba5b01178200ea1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccbe9c7de910ee51d1c278f566847e6a0ed29a68bd12c9266ba5b01178200ea1.dll,#1
  2⤵
  PID:5112

memory/5112-133-0x0000000000880000-0x000000000088D000-memory.dmp

Filesize
52KB

Download
memory/5112-135-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/5112-138-0x0000000000880000-0x000000000088D000-memory.dmp

Filesize
52KB

Download