06500a1a2f152b59ceeb662d7bd5bb07175bf45a9c2528b2f6de58394ada4bc5

Analysis

max time kernel
1615s
max time network
1582s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 18:56

Target

Compiled/Misc/Plugins/CRYP.dll
Size

25KB
MD5

b19e45df5dc69a8b3e0fd49e89e78d40
SHA1

39af74aaf48ec561cb7571a2a60e24ac9eb2c713
SHA256

44923b371567297a155bd7d588248f70e0add0802d358fc3ad334cc1cb6c4748
SHA512

14ff89305bdcf055ee9cd1e33a4978902ad3a62d879d906d1aa7fc18903d7f72b99858f0d556d97197014b8d45249fbd7542ca872f61d5e52873cf9eae44714c
SSDEEP

384:prWpPLh+1nJHGM/r6qVZkbTrmBVAaXezF5aGZ7hp6pW4jI3phy1wUViIBaFSDR8g:B+QZkLmhXe/aOhCW/6wCXMMVs4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1344	2524	rundll32.exe	84
PID 2524 wrote to memory of 1344	2524	rundll32.exe	84
PID 2524 wrote to memory of 1344	2524	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Compiled\Misc\Plugins\CRYP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Compiled\Misc\Plugins\CRYP.dll,#1
  2⤵
  PID:1344