d0ccf3762210bd02b14a5b710583220e965a5f46ed2e1449402998b01a722d78

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 03:03

Target

d0ccf3762210bd02b14a5b710583220e965a5f46ed2e1449402998b01a722d78.dll
Size

184KB
MD5

56299d01be1ad4f0480f4ef0e36774f4
SHA1

cf389c45dd2dbf07a022791f5cf2177852c34bea
SHA256

d0ccf3762210bd02b14a5b710583220e965a5f46ed2e1449402998b01a722d78
SHA512

e92e889c47cfdb50844b22ff4a8a4bb560f1de5e495adbf3a2353ca874c54f744849517d4922e24bc74b1703a844946ce5fdaf8ba7844247218cccab3972aea5
SSDEEP

3072:K5z1B1kNtTUg0M4PsJ2AgzY7bi0OcgU70fsNOKBXuFWexg2lQBV+UdE+rECWp7hA:KN1BCtTUg0aEY7bi0170ENOKxuFWdBVJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 1876	3976	rundll32.exe	82
PID 3976 wrote to memory of 1876	3976	rundll32.exe	82
PID 3976 wrote to memory of 1876	3976	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0ccf3762210bd02b14a5b710583220e965a5f46ed2e1449402998b01a722d78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0ccf3762210bd02b14a5b710583220e965a5f46ed2e1449402998b01a722d78.dll,#1
  2⤵
  PID:1876