c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 03:52

Target

c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll
Size

548KB
MD5

3182365a61692919f67a612dcfac1b24
SHA1

7e65586ee2c14b0ed864914d637a6682ff73b60b
SHA256

c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7
SHA512

bd701f61232ba158eed85610ce88bd960e775f35745e80d0f2a028e77927915f7410cc45fb20f70163ceff2181c8a8a9c0f292f0113c008ee17a13c9fd7cd98d
SSDEEP

6144:YltBsygUtAzpmWJqAiF+vAeDukzhQs1fjVcR/SnmFaB7aS7gtRHG4YSfvj7D5bN/:gttcPzhjZm3nNqmomAgiakjZQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2420	4684	rundll32.exe	86
PID 4684 wrote to memory of 2420	4684	rundll32.exe	86
PID 4684 wrote to memory of 2420	4684	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll,#1
  2⤵
  PID:2420