ccc2775deef8436436f7b5c7178020cf767b2f4b93a6538e7c95503b670e2050

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 03:07

Target

ccc2775deef8436436f7b5c7178020cf767b2f4b93a6538e7c95503b670e2050.dll
Size

5KB
MD5

8b48d1da0cf56bf612fd0acae780987c
SHA1

7bbee4cb894b02296ec8ee4a4ced7891b465da65
SHA256

ccc2775deef8436436f7b5c7178020cf767b2f4b93a6538e7c95503b670e2050
SHA512

cae7f98db0a75c3118a77e49319a7b97d21eda3c6027c18deb5a6b10f69573e684e86fb29e2843fc2e50d8d130624bf8996772ac0a313d5bbb014feb707bae48
SSDEEP

96:hy859x0P8MaaRUJuPm2rOVlasF6h9pUcn:F5oL/RUJuL6Vlt4qc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3472	3152	rundll32.exe	81
PID 3152 wrote to memory of 3472	3152	rundll32.exe	81
PID 3152 wrote to memory of 3472	3152	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccc2775deef8436436f7b5c7178020cf767b2f4b93a6538e7c95503b670e2050.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccc2775deef8436436f7b5c7178020cf767b2f4b93a6538e7c95503b670e2050.dll,#1
  2⤵
  PID:3472