134c5d1acefee78416ad78742e402a3992bf3ab31ce21a7c3bf07cf4e182ef22

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 16:11

Target

Modules/CdPrc.dll
Size

88KB
MD5

fd758bb81a99621d73d6157d1e8e168b
SHA1

27c649f3d0d3aa25396705ee0f97be1c5f8f608e
SHA256

abb1c1eab73b63dc96e626c24f5025c184c749285254a26c3d8e913bd808fca4
SHA512

b4fe3393537061fa7977382bf59a102d3d13f358fdde4df3271494b6f10ea31b7e2b6e6b2082c35f9e632979df6176dce447e60a1eccd6ee0454ba03db4e48c7
SSDEEP

1536:XF9wrgScEr7fYnX0FMDvy/OtmkYtbSK6RpduYF36o5qW/c3NwlQFS3is:39MgnX8MDvyGtmlCRpYYF36dW/c3NwRF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 1884	3576	rundll32.exe	84
PID 3576 wrote to memory of 1884	3576	rundll32.exe	84
PID 3576 wrote to memory of 1884	3576	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\CdPrc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\CdPrc.dll,#1
  2⤵
  PID:1884