a36472a76e10fcc53afbcc8ecd7430c5e2c309964fd456348f8474aac02d9dc9

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:05

Target
cvery.comvc61544667824/exe/1sass.dll
Size 32KB
Sample231231-ens2rsfedm
SHA256 a9c8de61278740ff5d0bf4258c38545353a7093faab5b1ec99a51f01e95fbb5a
MD5 5bf6e6b6de744585ab9e8b73fb786394
SHA1 856719a21a34df6629ae17ada220e39018f40405
SHA512 bdb1b9ad9d1f6f286e8eaaf7167d217f9d37ae01ac91ff2f44d4a29804c2919ebca2052c71b2bf0b0944ada652fbb776ae49b7d7337189a23f9547aaba35e5e5
SSDEEP 384:hkyPzazml//tBZTZ3PjNXpkqlyyx6mG1o9z:hDvtBZTZ/bk22J1o9z
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1988	540	rundll32.exe	14
PID 540 wrote to memory of 1988	540	rundll32.exe	14
PID 540 wrote to memory of 1988	540	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvc61544667824\exe\1sass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cvery.comvc61544667824\exe\1sass.dll,#1
  2⤵
  PID:1988