7cc22a5a488e5648522c99b3a64707e2b2cfaf137627c5d319dedf1522164aa4

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 23:16

Target

7cc22a5a488e5648522c99b3a64707e2b2cfaf137627c5d319dedf1522164aa4.dll
Size

327KB
MD5

121ccd36e63b4b316e7c39cda2715780
SHA1

85720e420e5d8eb8c18f28528d7e2ab3ea9d0a8e
SHA256

7cc22a5a488e5648522c99b3a64707e2b2cfaf137627c5d319dedf1522164aa4
SHA512

9489ec6735920a16ce0febc9f75bbe7d73c3ce39d443ccca0f225bdd5ff899f2948e57fd40ee7bdb9400356169b918d9cc44d0c91a833a918d1765ef9aa84739
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1284	4816	rundll32.exe	82
PID 4816 wrote to memory of 1284	4816	rundll32.exe	82
PID 4816 wrote to memory of 1284	4816	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cc22a5a488e5648522c99b3a64707e2b2cfaf137627c5d319dedf1522164aa4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cc22a5a488e5648522c99b3a64707e2b2cfaf137627c5d319dedf1522164aa4.dll,#1
  2⤵
  PID:1284