c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/cmm.dll
Size 188KB
Sample240603-pypr7sgc32
SHA256 ea68a79686fcfef9f1b0c9c164cca1adee62113d46d7dc7efcb93d73180dfc5b
MD5 09f3599ea16b29d058af4643ca3de114
SHA1 8c159ffca46e1ab3f68060694bd51dcfd7b5ca91
SHA512 1b7f27eaa3030a53735402b11b41e2a76fdd69f09f33184696d2394043fa4319a2615849e77e56e11995dd464be525c2c622f743ca37f37574fa77d4b0b4c0f0
SSDEEP 3072:svkU0Rh5hA/qvraiLSNyUuiZtoc4qToCe98cecykbyHeS9h:1U0RhgqDaiL0ToxqToj8rcG79
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 992	2064	rundll32.exe	83
PID 2064 wrote to memory of 992	2064	rundll32.exe	83
PID 2064 wrote to memory of 992	2064	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\cmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\cmm.dll,#1
  2⤵
  PID:992