cf272ebdff545c37f1829fd4f6e180e9d9bff24080364b8a0bb97cdba5d9648c

Analysis

max time kernel
9s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 08:27

Target

cf272ebdff545c37f1829fd4f6e180e9d9bff24080364b8a0bb97cdba5d9648c.dll
Size

273KB
MD5

e87bdced6bbd324a1b31280f737bed63
SHA1

dbb0bcf80a76e654c776b1b51f98d0830fba8080
SHA256

cf272ebdff545c37f1829fd4f6e180e9d9bff24080364b8a0bb97cdba5d9648c
SHA512

2f500eb4a0cdfa07ba659693a25cdc893bd7fe157d6ed8f883bc8e8dd5071f6ad7d4f350f8de6a13b08ec1837051aea3ef26441d995d04de28643b089f782155
SSDEEP

6144:zEzrdPfAeJnDinggIbheqU83DOo/pOgzSNmgiOd2vcKk0:QHtfVJDingNb1jBOTEvu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf272ebdff545c37f1829fd4f6e180e9d9bff24080364b8a0bb97cdba5d9648c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf272ebdff545c37f1829fd4f6e180e9d9bff24080364b8a0bb97cdba5d9648c.dll,#1
  2⤵
  PID:1588

memory/1588-132-0x0000000000000000-mapping.dmp

Download
memory/1588-133-0x0000000073720000-0x000000007376C000-memory.dmp

Filesize
304KB

Download