a751a8851b78855af863d475d72afa8f26d86bc0bc8415c8e9d490eaebc15cf2

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:28

Target

crpe32.dll
Size

5.1MB
MD5

4cff315c080d9dfb756552646e6b01be
SHA1

76a65360d990d3c6fb847f21b9ec1efbeef6bae2
SHA256

a751a8851b78855af863d475d72afa8f26d86bc0bc8415c8e9d490eaebc15cf2
SHA512

a52000307af40e787022b00702413418174e5fd4d4e34da24d548c1491cd92eeee0ee36b11d3087e408e2667f71f24b97c8395f430511bc21ba6f72ca0afa3e8
SSDEEP

49152:mBJ+LcDB0Ix32ouHDNBsjMf/ZmWRWG6tuKpIDBdj3EF9CZGMd2dRpkBJVsmQj24:c45BeMXh0G6t1pIDbgF9NdRpkKmE2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 4260	2792	rundll32.exe	83
PID 2792 wrote to memory of 4260	2792	rundll32.exe	83
PID 2792 wrote to memory of 4260	2792	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\crpe32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\crpe32.dll,#1
  2⤵
  PID:4260