0cc56028d7279b72a7f85273efd06030bde1db7b3846121cdd7f06d9228a4dd5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 18:34

Target

0cc56028d7279b72a7f85273efd06030bde1db7b3846121cdd7f06d9228a4dd5.dll
Size

342KB
MD5

c7a5b0f1ecf62785ec22a925363ca243
SHA1

d6a29322a5aac7634f4bd885a55ae5cb051cee8e
SHA256

0cc56028d7279b72a7f85273efd06030bde1db7b3846121cdd7f06d9228a4dd5
SHA512

6218f358b30f55ac86e2258987cf5d65ed222719096b4dee3deb1307024949d5d8cfe00c55a90de0fc731c513e1c140091646730a9798fa0c2276952434ad3ed
SSDEEP

6144:cRoOpXN8bEvZehNyi5qlscXsKCkSLjn7WQDilmvWpJJvEir:cRoOpXCjNwlscXeJikilmvYEir

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2688	2612	rundll32.exe	86
PID 2612 wrote to memory of 2688	2612	rundll32.exe	86
PID 2612 wrote to memory of 2688	2612	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cc56028d7279b72a7f85273efd06030bde1db7b3846121cdd7f06d9228a4dd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cc56028d7279b72a7f85273efd06030bde1db7b3846121cdd7f06d9228a4dd5.dll,#1
  2⤵
  PID:2688