1ccab6b3bc3155a6bdbea9ecc8f8e38d125c1c1dc74b6519a4b986297240f796

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 07:22

Target

1ccab6b3bc3155a6bdbea9ecc8f8e38d125c1c1dc74b6519a4b986297240f796.dll
Size

1.6MB
MD5

827a6d37fb06ced329dfb2ba0760ac0c
SHA1

9d2eb2ec8bda4396f9060801b774ef69ad193c91
SHA256

1ccab6b3bc3155a6bdbea9ecc8f8e38d125c1c1dc74b6519a4b986297240f796
SHA512

27d6268881cb32b5d84e12144a412fa9a803e859d9c057b9558551b4904f6af87dbbe0271881f20a0d11957cb2bd7b5703fda7acef4684453280e1a5b1d421f2
SSDEEP

49152:COIydfuC31HE8gd3VyVeAZIy5GdQ+sdB:CXydfVHElgXGdFsdB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4892	4564	rundll32.exe	85
PID 4564 wrote to memory of 4892	4564	rundll32.exe	85
PID 4564 wrote to memory of 4892	4564	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ccab6b3bc3155a6bdbea9ecc8f8e38d125c1c1dc74b6519a4b986297240f796.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ccab6b3bc3155a6bdbea9ecc8f8e38d125c1c1dc74b6519a4b986297240f796.dll,#1
  2⤵
  PID:4892

memory/4892-0-0x0000000000DE0000-0x0000000000DE6000-memory.dmp

Filesize
24KB

Download
memory/4892-1-0x0000000010000000-0x000000001019D000-memory.dmp

Filesize
1.6MB

Download
memory/4892-3-0x0000000002E40000-0x0000000002F4F000-memory.dmp

Filesize
1.1MB

Download
memory/4892-4-0x0000000002F50000-0x0000000003045000-memory.dmp

Filesize
980KB

Download
memory/4892-7-0x0000000002F50000-0x0000000003045000-memory.dmp

Filesize
980KB

Download
memory/4892-8-0x0000000002F50000-0x0000000003045000-memory.dmp

Filesize
980KB

Download
memory/4892-9-0x0000000010000000-0x000000001019D000-memory.dmp

Filesize
1.6MB

Download