2cf36b5e3ddcf7bcc0c077109b4fb5c8010b129759096755ecb1eeeb19b6a2e9

Analysis

max time kernel
99s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 19:55

Target

2cf36b5e3ddcf7bcc0c077109b4fb5c8010b129759096755ecb1eeeb19b6a2e9.dll
Size

81KB
MD5

7435864e80ffc9f21285f8d9182e0ed7
SHA1

3cf02bebe737a5aaa61ef428cb150090be115788
SHA256

2cf36b5e3ddcf7bcc0c077109b4fb5c8010b129759096755ecb1eeeb19b6a2e9
SHA512

01c7cbf41fe1ca876c95437508d0d105dff80bed96bcdfc7013d41bb9e44375258b2a46ab46827fdea0813188dfa7d30e5ce579d2b08f66854a8b7c7ac20b9d9
SSDEEP

1536:aByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Ws:7v4JKXTx71wnArSsXFpeXq8Ws

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2372	644	rundll32.exe	89
PID 644 wrote to memory of 2372	644	rundll32.exe	89
PID 644 wrote to memory of 2372	644	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf36b5e3ddcf7bcc0c077109b4fb5c8010b129759096755ecb1eeeb19b6a2e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf36b5e3ddcf7bcc0c077109b4fb5c8010b129759096755ecb1eeeb19b6a2e9.dll,#1
  2⤵
  PID:2372