cfdd11efcd080b184c51cb00446ab46f68bc4fa20cfc1195e19df2726f2e207f

Analysis

max time kernel
137s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:34

Target

cfdd11efcd080b184c51cb00446ab46f68bc4fa20cfc1195e19df2726f2e207f.dll
Size

6KB
MD5

adedbcd97b732da04caeeabfae026a90
SHA1

49bb5689dcb50f87ba599c850027faf39acdbc64
SHA256

cfdd11efcd080b184c51cb00446ab46f68bc4fa20cfc1195e19df2726f2e207f
SHA512

69479944cb0910b4431ee0f02abddee5e237fd1a1290aa8416e7c5b88ac81d7ca292b41b1b3d14c4de83e809a949ca585e7c4417667953f43f176adae7aa79c7
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD7raJ9F:nGTWJGp0UZUd6378snt7UF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4960	4952	rundll32.exe	80
PID 4952 wrote to memory of 4960	4952	rundll32.exe	80
PID 4952 wrote to memory of 4960	4952	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfdd11efcd080b184c51cb00446ab46f68bc4fa20cfc1195e19df2726f2e207f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfdd11efcd080b184c51cb00446ab46f68bc4fa20cfc1195e19df2726f2e207f.dll,#1
  2⤵
  PID:4960