cad9dd3b76cc17c11d94b29fb4f84ea41493d362b3ef794cf43f6c720a36420f

Analysis

max time kernel
149s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:25

Target

cad9dd3b76cc17c11d94b29fb4f84ea41493d362b3ef794cf43f6c720a36420f.dll
Size

96KB
MD5

fd20b23437ce4648fbe00f19ed6765c1
SHA1

cfd716e092800ccf9503edd0b3711d0798102780
SHA256

cad9dd3b76cc17c11d94b29fb4f84ea41493d362b3ef794cf43f6c720a36420f
SHA512

cb1bcaf62cafd9868847f21e9fd3ff49c189000142017b445531a0ce0ba0d85658294042ea661420eaea95d1669f3833276abf1db6e3ca758cc6b8f352e8a9fa
SSDEEP

1536:TD6K271gp7DXHQ49Ah/4Y25LxInML24NeMmbAR2dj/9xDpdO7w:TDGYLwweQYwCY248dO2x9xDpdz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 3196	3156	rundll32.exe	81
PID 3156 wrote to memory of 3196	3156	rundll32.exe	81
PID 3156 wrote to memory of 3196	3156	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cad9dd3b76cc17c11d94b29fb4f84ea41493d362b3ef794cf43f6c720a36420f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cad9dd3b76cc17c11d94b29fb4f84ea41493d362b3ef794cf43f6c720a36420f.dll,#1
  2⤵
  PID:3196

memory/3196-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download