ccec216a01f3f810db531464e12f0645577954a7c7e2a056791c4e73145f9146

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 02:37

Target

ccec216a01f3f810db531464e12f0645577954a7c7e2a056791c4e73145f9146.dll
Size

5KB
MD5

e6391478f1cd59eae6a391ef3600799c
SHA1

f1f477cea634cbef7a0834d56804f856fca250bf
SHA256

ccec216a01f3f810db531464e12f0645577954a7c7e2a056791c4e73145f9146
SHA512

bda3b91ef0da88b9382d7d6e6d0b7e14bc458e6dd344ed1f12a4d044bcbeedf21446328e51ec85647b7f2c2f52faeed7f7961e62d9b4572d1ace59cd9d927146
SSDEEP

96:nEY2RrF1eqwi4AcFRQFixFif2Syf0JTrMpNqG92:EHRh1eppAJFifx9IPY1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28
PID 2860 wrote to memory of 2912	2860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccec216a01f3f810db531464e12f0645577954a7c7e2a056791c4e73145f9146.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccec216a01f3f810db531464e12f0645577954a7c7e2a056791c4e73145f9146.dll,#1
  2⤵
  PID:2912