c335a2c33cb4f9d4c655f57f48889801164e4125b569acb7fd73aa5389bed64d

Analysis

max time kernel
128s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 10:32

Target

c335a2c33cb4f9d4c655f57f48889801164e4125b569acb7fd73aa5389bed64d.dll
Size

120KB
MD5

5d1bf3312361a7ff443eec09d2ae3daa
SHA1

b79bb4e20b7a935218ad6d5c8f6618d2e5db81bb
SHA256

c335a2c33cb4f9d4c655f57f48889801164e4125b569acb7fd73aa5389bed64d
SHA512

dff7d07ccda794e8fd05f3665cb9ca442447d105c4b57a3d8a10957270d448627486c0c0a6ddb5d6fc40ba024067428a221dfdbe1bdd99126954cea6ca264614
SSDEEP

3072:F6l8nQzA7LkQqm4+RIUJUw7/7cJEY2Bg7PY:F8tzAcQR4237/7zBg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4352	4712	rundll32.exe	83
PID 4712 wrote to memory of 4352	4712	rundll32.exe	83
PID 4712 wrote to memory of 4352	4712	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c335a2c33cb4f9d4c655f57f48889801164e4125b569acb7fd73aa5389bed64d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c335a2c33cb4f9d4c655f57f48889801164e4125b569acb7fd73aa5389bed64d.dll,#1
  2⤵
  PID:4352