cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633

Analysis

max time kernel
199s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 11:24

Target

cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633.dll
Size

6KB
MD5

702df7a840dc2585c03626ae6945f770
SHA1

7751793e18045da33026d63fdd285a037f286206
SHA256

cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633
SHA512

5710b41182065d3e2dac4fb692dc66473aedbbe414f9280edc2f63d88684585b63c27175087a4d94cd89537621abff8742ab0185a763b21bb36a454aa4c215b6
SSDEEP

96:nGTKrYJyJ5gT9jXk9eXWI/n9e1r/CVd7p0jsnmUD76hXaF:nGTWJGp0UZUd6378snt7kaF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4936	5052	rundll32.exe	80
PID 5052 wrote to memory of 4936	5052	rundll32.exe	80
PID 5052 wrote to memory of 4936	5052	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe9fd2ff5ac201e7a5f5d969bbde19462701d781e8188275ebe65f9cbb6d633.dll,#1
  2⤵
  PID:4936