c568714ef22fdfcf27391b2efe2ee1fd730628a8b1b43e2ce92fe3aa87b02948

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:57

Target

PCPTpm12.dll
Size

358KB
MD5

ab3779934346acf9d51f24494ea81c70
SHA1

c709e137d6e14d08ad53bc3fbb5df1b88eb0fd91
SHA256

c568714ef22fdfcf27391b2efe2ee1fd730628a8b1b43e2ce92fe3aa87b02948
SHA512

7658c5958c3ed0fd7c786f7c571a283b2aab3c0aaed6a31023945b69ca1ed398edf4d296aa2f149f4a108229fc07e3640038dad030dd7d2e29a1891236417f3d
SSDEEP

6144:cKJQOcGTxWO73Ebf7SEi8M/JKNoIxWFViSbaIHj/hdvY0YNADye0sCpW8+ZORnoS:BJ0GFW63i7SX/JKC5dzCAOeB/ERna6U2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 232	4368	rundll32.exe	82
PID 4368 wrote to memory of 232	4368	rundll32.exe	82
PID 4368 wrote to memory of 232	4368	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCPTpm12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCPTpm12.dll,#1
  2⤵
  PID:232