ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 02:47

Target

ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89.dll
Size

81KB
MD5

bccf9ee10456a0f239e8399ba171f16e
SHA1

706c67791638d9e945e1a3dd0753c5f5275622ba
SHA256

ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89
SHA512

2d7332455ecef102e54723b2cfd7c65e48e4e3073c3ae8ca4a4031eca215d085d8f6673c244269e54b05e954fed4800916ac8effa567a3ed00028afb50c7095e
SSDEEP

1536:4c+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GN:X+5oxmqAiR8+/RBkez0U+y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2300	2972	rundll32.exe	28
PID 2972 wrote to memory of 2300	2972	rundll32.exe	28
PID 2972 wrote to memory of 2300	2972	rundll32.exe	28
PID 2972 wrote to memory of 2300	2972	rundll32.exe	28
PID 2972 wrote to memory of 2300	2972	rundll32.exe	28
PID 2972 wrote to memory of 2300	2972	rundll32.exe	28
PID 2972 wrote to memory of 2300	2972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89.dll,#1
  2⤵
  PID:2300