cd6c2ed79522c428429e5a3e89c6299cb02b0f96ce40de3d385171e482d01c80

Analysis

max time kernel
1s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2023, 20:34

Target

cd6c2ed79522c428429e5a3e89c6299cb02b0f96ce40de3d385171e482d01c80.dll
Size

60KB
MD5

1c0227aacc3e92c64d25349cb1f65102
SHA1

cf0646ee140c7b707245b5104fc5e9299d92881b
SHA256

cd6c2ed79522c428429e5a3e89c6299cb02b0f96ce40de3d385171e482d01c80
SHA512

21fe68516aa073e1060592cc52fd620d0292ed3063374e61c4bf7cd739ecc84690326936824349c806fba8fa8fb44e361a9c13314debb0b78557c2f0cf0bc6ab
SSDEEP

1536:hQ3I3TW85xC2ThO2B/AGPbmk8boqEChv:h+UVT6GPbm3boqEC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 3684	4020	rundll32.exe	80
PID 4020 wrote to memory of 3684	4020	rundll32.exe	80
PID 4020 wrote to memory of 3684	4020	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd6c2ed79522c428429e5a3e89c6299cb02b0f96ce40de3d385171e482d01c80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd6c2ed79522c428429e5a3e89c6299cb02b0f96ce40de3d385171e482d01c80.dll,#1
  2⤵
  PID:3684

memory/3684-133-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download