ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 02:47

Target

ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89.dll
Size

81KB
MD5

bccf9ee10456a0f239e8399ba171f16e
SHA1

706c67791638d9e945e1a3dd0753c5f5275622ba
SHA256

ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89
SHA512

2d7332455ecef102e54723b2cfd7c65e48e4e3073c3ae8ca4a4031eca215d085d8f6673c244269e54b05e954fed4800916ac8effa567a3ed00028afb50c7095e
SSDEEP

1536:4c+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GN:X+5oxmqAiR8+/RBkez0U+y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4804	3020	rundll32.exe	83
PID 3020 wrote to memory of 4804	3020	rundll32.exe	83
PID 3020 wrote to memory of 4804	3020	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccfc5b347ad7da42434c8a3a6f0f7616645dfc08ced5ab6644c7ed3300505d89.dll,#1
  2⤵
  PID:4804