4cfefb50ecb11a3b74e99c3cebd223b9b393b3e577d947f68e4e261344e989b6

Analysis

max time kernel
162s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 18:24

Target

4cfefb50ecb11a3b74e99c3cebd223b9b393b3e577d947f68e4e261344e989b6.dll
Size

19KB
MD5

7c9837455a5d21a979a666e4beda30b0
SHA1

98a5b0575e91d9882d5b6febe5f1879a8e158147
SHA256

4cfefb50ecb11a3b74e99c3cebd223b9b393b3e577d947f68e4e261344e989b6
SHA512

f82c890aa66b2de9669a748ca6cb8c5ad038245bf782f3d73159c8d067b7d3805c6ff5050b498af1af0ff0fc640a927a1be1bee9df811fe2a254a38732b6705f
SSDEEP

384:/AZt1gfEhDsrQ800i80zY4+j7JdZgU0FaXE8:/AZt1hhDsGn80zpW7JdZgtFaXE

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
12	3204	rundll32.exe
22	3204	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3204	4888	rundll32.exe	82
PID 4888 wrote to memory of 3204	4888	rundll32.exe	82
PID 4888 wrote to memory of 3204	4888	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cfefb50ecb11a3b74e99c3cebd223b9b393b3e577d947f68e4e261344e989b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cfefb50ecb11a3b74e99c3cebd223b9b393b3e577d947f68e4e261344e989b6.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3204